build(deps): google-genai >=2.16.0 + regenerated CI lock (supersedes #407)

[WalksWithASwagger]

Summary

Migrates google-genai to >=2.16.0 and regenerates the hashed Python 3.11 CI lock so the test gate passes. Closes out the tracking work in #421.

Supersedes #407 (Dependabot google-genai >=1.0.0 → >=2.16.0), which currently FAILS CI. #407 bumped only requirements.txt and left requirements-ci.txt pinning google-genai==2.12.1 (< 2.16.0), so the test job's "Check Python CI lock" step (npm run lock:python-ci + git diff --exit-code) fails on the stale lock. Please close #407 in favor of this PR — I have not touched it.

What changed

• requirements.txt: google-genai>=1.0.0 → google-genai>=2.16.0
• requirements-ci.txt: regenerated with the repo's exact toolchain (pip-compile 7.6.0 under Python 3.11.10, same --pip-args targeting manylinux_2_17_x86_64 / cp311). Lock delta is limited to the target plus one transitive dep:
  • google-genai 2.12.1 → 2.16.0
  • google-auth 2.55.2 → 2.56.2

The pip-compile header is byte-identical to the previous lock (same recorded command), so CI's own npm run lock:python-ci regeneration reproduces this file and the git diff --exit-code gate passes.

No provider code changes required

lib/providers/gemini.py needs no edits. The codebase was already running on google-genai 2.x — the prior >=1.0.0 floor resolved to 2.12.1 in the lock, and main's CI has been green on it. 2.16.0 is a minor bump within the same major and its changelog is purely additive (environment resource, GoogleMaps grounding, audio transcription, Imagen deprecation warnings — none used here).

I verified by introspection that every API the provider uses still exists and constructs under 2.16.0: genai.Client(api_key=...), types.ImageConfig{aspect_ratio, image_size}, types.GenerateContentConfig{response_modalities, image_config}, models.generate_content(...), response.parts, Part.inline_data, Part.as_image().

Verification performed (offline)

• Lock regenerated with CI-matched toolchain (Python 3.11.10, pip 26.1.2, pip-tools 7.6.0); header byte-identical, diff limited to genai + google-auth.
• Hashed cross-platform resolve confirmed google-genai==2.16.0 and google-auth==2.56.2 wheels + hashes are valid for the manylinux_2_17_x86_64 / cp311 CI target.
• API-surface introspection under 2.16.0: all 11 checks PASS.
• pytest tests/test_providers.py under Python 3.11 with 2.16.0 installed: 10 passed (incl. the importorskip("google.genai") no-API-key path).

⚠️ LIVE GENERATION DRY-RUN BY MAINTAINER REQUIRED BEFORE MERGE — offline CI cannot verify the provider

Green CI is necessary but NOT sufficient here. The offline test suite mocks the provider and only exercises google.genai's importability plus the no-API-key early-return; it never calls generate_content, response.parts, or Part.as_image(). This is the highest-blast-radius dependency in the repo. A maintainer must run one real image-generation dry-run against Gemini with a live GOOGLE_API_KEY before merging. I did not call the live provider, generate any image, or spend money.

Do not enable auto-merge. Review-ready only.

Refs #421