fix(deps): migrate @google-cloud/vertexai to @google-cloud/agentplatform, −16 MB and dedupes @google/genai

`@google-cloud/vertexai` has been renamed to `@google-cloud/agentplatform`. The old package is frozen at 1.12.0; the successor is actively released (0.11.0 on 2026-08-25) and is where fixes now land.

This is the change that resolves #796, and it is more than a rename: module paths moved, two types were renamed, and one API we depend on was removed outright. Splitting it out of #796 so the migration has its own scope, and out of the tracking issue #797 so the follow-ups are not lost.

Branch `fix/migrate-agentplatform`, based on `origin/main`.

## Why now

`@google-cloud/vertexai@1.12.0` pins `@google/genai: ^1.45.0` against our `^2.9.0`, so npm nests a second 16 MB copy. That pin was never fixed in `vertexai` — it was fixed in the successor:

```
@google-cloud/agentplatform 0.10.0 {"@google/genai":"^1.45.0","google-auth-library":"^9.1.0"}
@google-cloud/agentplatform 0.11.0 {"@google/genai":"^1.45.0 || ^2.0.0"}
```

## Result

Clean install of `core`'s production dependencies into an empty directory, warm npm cache, Node v26.7.0, apparent bytes:

| | tree | packages | `@google/genai` copies | `google-auth-library` copies |
|---|---:|---:|---:|---:|
| `@google-cloud/vertexai@1.12.0` | 106.4 MB | 171 | **2** | 3 |
| `@google-cloud/agentplatform@0.11.0` | **90.4 MB** | **163** | **1** | **1** |
| | **−16.0 MB** | **−8** | | **−2** |

Above the ~15 MB projected in #796, because 0.11.0 also drops `google-auth-library` entirely, collapsing two more copies beyond the genai dedupe.

## What the migration involves

**1. Module paths moved** — `build/src/genai/*` → `build/src/*`:

```diff
-import {Sessions} from '@google-cloud/vertexai/build/src/genai/sessions.js';
+import {Sessions} from '@google-cloud/agentplatform/build/src/sessions.js';
```

**2. Two types renamed** (the `AgentEngine` prefix was dropped). Field sets verified identical by diffing the declarations:

| before | after |
|---|---|
| `AgentEngineMemoryConfig` | `MemoryConfig` |
| `GenerateAgentEngineMemoriesConfig` | `GenerateMemoriesConfig` |

**3. `Memories` is no longer reachable from `Client`** — the one part that is not mechanical. `Client.agentEnginesInternal.memories` is gone, at runtime and not just in the typings:

```
agentEngines keys: apiClient, sessions, sandboxes
agentEngines.memories at runtime: undefined
```

`Memories` now hangs off `MemoryBanks`, which `Client` does not surface. The branch works around it by constructing one directly — `Memories` takes an `ApiClient`, and the client holds one but declares it `protected`:

```ts
function memoriesFor(client: Client): Memories {
const {apiClient} = client as unknown as {
apiClient: ConstructorParameters[0];
};
return new Memories(apiClient);
}
```

**This is a step backwards** and should not survive. We went from a public (if self-described "experimental") getter to casting past `protected` to reach an internal — precisely the fragility #801 was fixing. Isolated to one helper with a TODO. Asked upstream for a supported accessor: googleapis/nodejs-agentplatform#675.

## Files

17 changed: `core/package.json`, 6 source files, 6 unit tests, 4 integration tests, `package-lock.json`. 89 insertions, 184 deletions.

The memory service tests needed rewiring — they mocked `client.agentEnginesInternal.memories`, which no longer exists. They now intercept the `memories.js` module so the service's direct construction returns the fake; all 33 assertions preserved unchanged.

## Verification

- `npm run ts:check` clean
- `npm run build` clean
- `npm run lint`, `npm run format:check` clean
- `npm run test:unit` — **247/247 files, 3774/3774 tests**

**Not verified:** integration tests. They need live credentials and cover exactly the Agent Engine session, memory and sandbox paths this touches. These should be run before merge — the `memoriesFor` workaround in particular is only exercised against a mock in unit tests.

## Follow-ups this leaves open

- [ ] Replace `memoriesFor` once agentplatform exposes a supported accessor (googleapis/nodejs-agentplatform#675)
- [ ] Five call sites still import unsupported `build/src/**` internals across `sessions`, `memory`, `code_executors` and `dev/cli`. There is no `exports` map protecting them, so they resolve — but #801 already had to fix one when a path moved, and this migration moved four more. Worth asking agentplatform for a supported surface, or narrowing what we depend on.
- [ ] `dev/src` imports the package without declaring it, relying on workspace hoisting. Pre-existing, not addressed here.

## Related

- #796 — the duplicate install this resolves
- #797 — overall size-reduction tracking
- #801 — moved `Client` off a deep import for the same class of reason
- googleapis/nodejs-agentplatform#675 — upstream range fix, and the open ask for a `Memories` accessor