Gemini CLI 0.55.1: sandbox escape, symlink escape and RCE fixes

Security:

• Symbolic-link directory escape in the memory import processor fixed.
• Sensitive-path blocklist is now case-insensitive; VS Code human-in-the-loop enforced.
• a2a-server enforces workspace trust and task isolation to prevent RCE; task cancellation now aborts the execution loop.
• macOS sandbox mounts ~/.gitconfig read-only; permissive Seatbelt profiles realigned to a deny-default model.
• Model thoughts stripped from scrubbed history turns (thought leakage).
• Mitigations for infinite ReAct loops and prompt-injection loops.

Other:

• Tool registry discovery added.
• write_file/replace bypass LLM correction for JSON and IPYNB files; escape sequences preserved in string literals.
• Plan-mode write policy simplified to support relative paths.
• Cancelled tool responses grouped and consecutive roles coalesced to stop 400 Bad Request.
• Clearer messaging when an account has no Code Assist tier; shared-project quota errors carry a setup hint.
• Vertex base URL updated; google-auth-library bumped to 10.9.0; cached-credential verification made sequential with GOOGLE_APPLICATION_CREDENTIALS fallback restored.
• Substantial internal "caretaker" triage/egress service work, plus eval coverage reporting — no user-facing effect.

Note: the upstream changelog is long and the captured source is truncated mid-list; the above covers what was captured.