feat(agy): add keyless image-analyze + search modes

image-analyze: independent second-model vision over OAuth (pins the
gemini-3.1-pro-preview vision model; the default flash-lite router
hallucinates image content) — reads an image via read_file and describes it.
search: Google-grounded live web results with citation URLs (google_web_search).
Both verified working on the keyless Google OAuth. Image GENERATION
(nano-banana) still needs an AI Studio key + extension and stays Grok's lane.
Includes a scoped best-effort output sanitizer for image-analyze (preview
model occasionally leaks reasoning tokens); text/verify/review/search
unchanged. migrate-identity.sh now upgrades the gemini capabilities array.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/scripts/migrate-identity.sh

@@ -164,7 +164,7 @@ if '$GEMINI_INSTALLED' == 'true':
     gm['installed'] = True
     gm['binary'] = r'$GEMINI_BIN'
     gm.setdefault('auth', 'oauth')
-    gm.setdefault('capabilities', ['text', 'verify', 'review'])
+    gm['capabilities'] = ['text', 'verify', 'review', 'image-analyze', 'search']
 else:
     gm['installed'] = False
 data['gemini'] = gm