@google/genai installed twice (~32 MB) via @google-cloud/vertexai's ^1.45.0 pin

## Summary

`@google/genai` is installed **twice** in this repo — ~16 MB each, ~32 MB total — because
`@google-cloud/vertexai@1.12.0` pins `@google/genai: ^1.45.0` while `core/package.json` pins
`^2.9.0`. The ranges can't dedupe, so npm nests a second copy.

```
16M node_modules/@google/genai # 2.9.0
16M node_modules/@google-cloud/vertexai/node_modules/@google/genai # 1.52.0
```

We've already paid for this once: `core/src/sessions/vertex_ai_session_service.ts:306` has a
structural error-matching workaround precisely because the nested copy's `ApiError` is a
different class object.

`google-auth-library` has the same problem more acutely — **eight copies, ~6.8 MB**
(v10.7.0, v10.9.1, and six on v9.15.1 via `googleapis`, `@google-cloud/storage`, both otel
exporters, `@google-cloud/vertexai` and `googleapis-common`).

## Proposed fix (short term)

Add to the **root** `package.json` — overrides are only honoured at the root of the install
tree, so this can't live in `core/package.json` and can't be inherited by our consumers:

```json
{
"overrides": {
"@google-cloud/vertexai": {
"@google/genai": "$@google/genai"
}
}
}
```

`$@google/genai` reuses the top-level resolution rather than hard-coding a version, so it
tracks `^2.9.0` automatically.

Verified on an isolated reproduction of the same dependency pair: **54 MB → 39 MB**, single
copy, and every `@google-cloud/vertexai` entry point we import still loads and constructs:

```
OK @google-cloud/vertexai
OK @google-cloud/vertexai/build/src/genai/client.js
OK @google-cloud/vertexai/build/src/genai/sessions.js
OK @google-cloud/vertexai/build/src/genai/memories.js
OK @google-cloud/vertexai/build/src/genai/types.js
OK new Client({project, location, vertexai: true})
```

**This needs a real test run before landing** — it forces a library built against genai v1
onto v2, and v1→v2 had breaking changes. The Agent Engine session, memory and sandbox paths
are the ones to exercise:

- `core/src/sessions/vertex_ai_session_service.ts`
- `core/src/memory/vertex_ai_memory_bank_service.ts`
- `core/src/code_executors/agent_engine_sandbox_code_executor.ts`
- `core/src/skills/gcp_skill_registry.ts`
- `dev/src/cli/deploy/cli_deploy_agent_engine.ts`

## Upstream fix (real one)

Filed on the `@google-cloud/agentplatform` repo asking for the range to be widened to
`^1.45.0 || ^2.0.0` or for `@google/genai` to become a peer dependency:
googleapis/nodejs-agentplatform — see linked issue.

An override in our root `package.json` fixes *our* `node_modules` but does nothing for
people installing `@google/adk`. Only the upstream range change fixes it for consumers.

## Should we migrate off `@google-cloud/vertexai`?

Worth deciding separately. `googleapis/nodejs-vertexai` has been renamed to
`googleapis/nodejs-agentplatform` and the package is now `@google-cloud/agentplatform`
(v0.10.0/0.11.0, actively developed). `@google-cloud/vertexai@1.12.0` looks like the legacy
name.

Two caveats:

1. Migrating does **not** fix the duplicate on its own — `@google-cloud/agentplatform` still
pins `@google/genai: ^1.45.0`. We'd still need the override until the upstream issue lands.
2. We currently reach into build internals in five places —
`@google-cloud/vertexai/build/src/genai/{client,sessions,memories,types}.js` — which are
not part of any public export map and could be renamed without a major bump. Worth
treating the migration as an opportunity to move onto supported entry points, or to
confirm with that team which of these are intended to be consumable.

## Related

Broader dependency-weight audit of `@google/genai` also turned up:

- `web-streams-polyfill` (8.8 MB) reaching us via `google-auth-library → gaxios → node-fetch`,
which is **never loaded** on Node ≥16.5 — upstream PR in progress at
googleapis/google-cloud-node#9101
- 7.94 MB of sourcemaps in `@google/genai`, 70% of it duplicated `sourcesContent` —
googleapis/js-genai#1884
- `protobufjs` pinned at `^7`, missing the `^8` release that dropped `@types/node` and nine
sub-packages — googleapis/js-genai#1883