feat(studio-cp): mint GKE tokens via gcp_auth instead of exec plugin (studio#119)

[brettchien]

Summary

Item 3 of #119's runbook. k8s_client_for() previously always let kube-rs shell out to whatever exec plugin a kubeconfig context declares. For GKE contexts that's gke-gcloud-auth-plugin — even with #122 (fix-path-env) fixing PATH inheritance in general, this still requires the plugin binary to actually be installed and correctly resolvable.

Fix

When the resolved context's exec.command is exactly "gke-gcloud-auth-plugin", skip the exec step entirely: fetch the bearer token in-process via gcp_auth (MIT), which walks the same Application Default Credentials chain the plugin itself reads (gcloud user creds → GOOGLE_APPLICATION_CREDENTIALS → GCE/GKE metadata server), then set it directly on AuthInfo.token (a SecretBox<str>, via secrecy::SecretBox::new) and clear AuthInfo.exec. No subprocess, no PATH dependency, for GKE specifically.

Other exec-based providers (Azure kubelogin is the one identified in #119) have no pure-Rust equivalent found — they still rely on #122's fix-path-env as the general-purpose fallback.

Verification

• Not locally compiled — same pre-existing aws-sdk-ec2 OOM limitation as fix(oab-mcp): install rustls CryptoProvider before first TLS handshake (studio#119) #120 (confirmed again this session, cargo check -p oab-mcp -j 1 OOMs on it regardless of target crate).
• Every API used was checked against docs.rs before writing this: gcp_auth::provider(), TokenProvider::token(&[scope]) -> Token, Token::as_str(), and secrecy::SecretBox::new(Box<S>) -> Self. secrecy is pinned to 0.10 to match kube 0.99's own resolved version (confirmed via cargo tree -e features -i ring earlier in k8s New Fleet wizard: rustls CryptoProvider panic + auth UX follow-ups #119's diagnosis, which showed secrecy v0.10.3 in the graph) — kube::config doesn't re-export the type, so this needs to be the same resolved crate version for AuthInfo.token's type to unify with what SecretBox::new produces here.
• CI's build-test job is the real compile gate.
• Recommend Brett re-test the GKE path for real after this merges (can't verify in this environment — no live GCP credentials, no running app).

Ref #119.

🤖 Generated with Claude Code