memory + rmm: agy-headless correction, gemini errorlog, bump guru-rmm (Syncro recon + spec plan)

- memory: agy.exe NOW works headless (v1.0.6+ --print/-p, --add-dir) — corrected
  reference_antigravity_agy_not_headless + MEMORY.md index; supersedes the old "DOA headless" note.
- errorlog: gemini-cli OAuth eligibility failure on this machine (agy/ask-gemini).
- bump projects/msp-tools/guru-rmm -> a7ecb9f (RMM_THOUGHTS Feature 11 OS Updates + RMM Fixes batch;
  docs/recon + docs/specs: Syncro policy/device recon + policy-redesign spec plan).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/memory/reference_antigravity_agy_not_headless.md

@@ -1,12 +1,24 @@
 ---
 name: reference_antigravity_agy_not_headless
-description: Antigravity CLI agy.exe is the IDE embedded agent (no stdout, SQLite store) — NOT a headless CLI. The agy skill uses @google/gemini-cli, not agy.exe. Don't reinstall agy.exe expecting a headless tool.
+description: UPDATE 2026-07-03 — agy.exe NOW works headless (v1.0.6+ --print/-p returns clean stdout). Use it as the Antigravity/Gemini second-model path. Older claim (DOA headless) is obsolete.
 metadata:
   type: reference
 ---
 
-The `agy.exe` installed by Google's Antigravity CLI (`%LOCALAPPDATA%\agy\bin\agy.exe`, installer `https://antigravity.google/cli/install.ps1`) is the IDE's embedded agent, **NOT a usable headless CLI** on this fleet. Even v1.0.6's advertised `-p/--print` produces ZERO stdout and hangs when invoked non-interactively from the Bash/PowerShell tool harness — it writes only to a SQLite conversation store. First found 2026-06-05 (`session-logs/2026-06-05-mike-gururmm-platform-day.md` line 35); **re-confirmed 2026-06-06** after the GURU-5070 reinstall (reinstalled agy.exe and walked straight back into the same no-output/hang symptom).
+**CORRECTION 2026-07-03 (GURU-BEAST-ROG):** `agy.exe` (Google Antigravity CLI,
+`%LOCALAPPDATA%\agy\bin\agy.exe`) **now has a working headless print mode.** `agy -p "<prompt>"
+--dangerously-skip-permissions` returns clean stdout and exits 0 (smoke-tested: returned "READY";
+also drove a full multi-file spec critique reading files via `--add-dir <dir>`). Flags: `-p/--print`
+(single non-interactive prompt), `--print-timeout` (default 5m), `--add-dir` (add a workspace dir so
+it can read files), `--model`, `--dangerously-skip-permissions` (auto-approve tools). Subcommands:
+`models`, `install`, `update`, `plugin`. Re-wire came from GURU-5070 fleet sync + a newer agy build.
+So agy IS now a usable Antigravity/**Gemini second-model** path, especially when `gemini-cli` OAuth
+fails (e.g. BEAST-ROG's `throwIneligibleOrProjectIdError`). NOTE: after install the binary is added to
+User PATH registry but NOT the active shell PATH until terminal restart — call it by full path
+`/c/Users/guru/AppData/Local/agy/bin/agy.exe` from the Bash tool.
 
-The `agy` SKILL (despite the name) routes to the official **`@google/gemini-cli`** (`gemini`, npm global) — that IS the real headless second-opinion tool (Google OAuth, no API key), resolved via `identity.json .gemini.binary`. Grok (`ask-grok.sh`) is the other working second model. Both were verified returning `OK` on 2026-06-06.
-
-**June 18 sunset — likely a non-issue for ACG.** Google is sunsetting gemini-cli's free/unpaid OAuth quota on **2026-06-18**, but Mike has a **paid Gemini account**, so the plan is to **stay on gemini-cli** (do NOT migrate to Antigravity). The bulletproof form is to auth gemini-cli with a paid **Gemini API key** (`GEMINI_API_KEY`) rather than the free OAuth quota — that path is unaffected by the OAuth-CLI sunset regardless of how the consumer tiers shake out, and is more stable for headless use. (Sources disagree on whether paid Pro/Ultra OAuth is also cut, so the API-key path is the safe bet.) **Do NOT reinstall agy.exe expecting it to work headless.** Related: [[feedback_agy_review_not_readonly]].
+**Historical (pre-2026-07-03, now OBSOLETE):** earlier agy.exe builds (~June 2026) produced ZERO
+stdout in `-p` mode and hung when driven headless (wrote only to a SQLite conversation store), so the
+`agy` SKILL was pointed at `@google/gemini-cli` instead. The gemini-cli path still exists
+(`ask-gemini.sh`) but on machines where its OAuth is ineligible, prefer **agy -p** now. Related:
+[[reference_cdp_chrome_driver]], [[feedback_agy_review_not_readonly]].