fix(plugins): package Gemini releases and improve OAuth

[zzAllenn]

Summary

• preserve the existing agentkey.skill GitHub Release asset and add platform-named Gemini extension archives for macOS, Linux, and Windows
• opt the Gemini extension into native first-connect OAuth with oauth.enabled, while keeping /mcp auth agentkey as the manual retry path
• add explicit Gemini, Antigravity 2.0, and Antigravity CLI authentication and connection-verification guidance
• explain Gemini's user-Skill precedence warning and avoid duplicate MCP registrations when an extension or plugin already owns the server entry
• add regression coverage and trigger the scripts test workflow when authentication guidance or release packaging changes

Root causes

Gemini CLI treats a lone generic GitHub Release asset as the extension archive. AgentKey releases currently publish only agentkey.skill, but Gemini CLI extracts only .tar.gz and .zip extension archives. After that extraction failure, Gemini retries Git clone in the same non-empty temporary directory and fails again.

Separately, the Gemini manifest omitted oauth.enabled. Gemini discovered that AgentKey required OAuth, but only reported /mcp auth agentkey instead of starting the browser flow automatically. A pre-existing user Skill at ~/.agents/skills/agentkey can also override the extension-bundled Skill, hiding new setup guidance even though the extension MCP entry is active.

Authentication design

• Gemini uses httpUrl plus oauth.enabled: true; OAuth endpoints and client registration remain dynamically discovered.
• Antigravity keeps the documented credential-free serverUrl configuration and uses DCR through its native Authenticate controls.
• No static access token, Authorization header, OAuth client secret, or hard-coded authorization endpoint is added to either package.

Validation

• Bats suite: 27/27 passing
• gemini extensions validate .
• built and inspected agentkey.skill, darwin.agentkey.tar.gz, linux.agentkey.tar.gz, and win32.agentkey.zip
• verified both Gemini platform archive formats contain oauth.enabled: true, gemini-extension.json, and skills/agentkey/SKILL.md
• validated workflow YAML, shell syntax, archive roots, manifest invariants, and git diff --check
• verified the live AgentKey endpoint advertises protected-resource metadata, PKCE, and a dynamic client registration endpoint

Release coordination

Merge this fix before release PR #92 so the first Gemini-enabled release publishes compatible archives and the corrected first-connect OAuth behavior.