gemini-cli: no fallback to API key when ACP capacity exhausted

[aider4ryder]

Bug Description

When using csa review with gemini-cli tool, if the ACP (OAuth) transport reports "No capacity available for model", CSA fails immediately instead of falling back to the global config's api_key or the [tools.gemini-cli.env] GEMINI_API_KEY.

Expected Behavior

CSA should detect the ACP capacity error and automatically retry using the API key configured in [tools.gemini-cli] section of the global config (~/.config/cli-sub-agent/config.toml), since the config comment explicitly says:

# Move to [tools.gemini-cli.env] section only when OAuth quota is exhausted.
api_key = "AIzaSy..."

Actual Behavior

CSA exits with exit_code = 1 and status = "failure" without attempting API key fallback.

Reproduction

pwd: /home/obj/project/github/RyderFreeman4Logos/mesh-proxy

csa review --sa-mode true --force-ignore-tier-setting \
  --tool gemini-cli --model google/gemini-3.1-pro-preview \
  --thinking xhigh --range main...HEAD

Session Details

• CSA version: 0.1.198 (v0.1.15-370-g65b780e-dirty)
• Session ID: 01KN292P5AP1TWMXAETTQZPD2W
• Session dir: ~/.local/state/cli-sub-agent/home/obj/project/github/RyderFreeman4Logos/mesh-proxy/sessions/01KN292P5AP1TWMXAETTQZPD2W

result.toml

completed_at = "2026-03-31T15:52:15.033132832Z"
exit_code = 1
started_at = "2026-03-31T15:44:29.404485098Z"
status = "failure"
summary = """
transport: ACP transport (sandboxed) failed: ACP prompt failed: No capacity available for model gemini-3.1-pro-preview on the server; stderr: Running scope as unit: csa-gemini-cli-01KN292P5AP1TWMXAETTQZPD2W.scope"""
tool = "gemini-cli"

Relevant Global Config

[tools.gemini-cli]
api_key = "AIzaSy..." # exists but was not used as fallback

# [tools.gemini-cli.env]
# GEMINI_API_KEY = "AIzaSy..." # commented out, intended for OAuth quota exhaustion

Proposed Fix

When gemini-cli ACP transport fails with a capacity/quota error, CSA should:

1. Detect the "No capacity available" error pattern
2. Check if api_key is configured in [tools.gemini-cli]
3. If available, retry with API key transport instead of ACP
4. If also unavailable, check [tools.gemini-cli.env].GEMINI_API_KEY
5. Only fail if all transport options are exhausted

[RyderFreeman4Logos]

Fixed in PR #537 (merged).

CSA now automatically detects OAuth capacity exhaustion ("No capacity available", 429, quota errors) and retries with the stored API key from [tools.gemini-cli].api_key config. No manual config editing needed.

Behavior:

1. First attempt always uses OAuth (no API key injected)
2. On capacity/quota error → reads api_key from tool config
3. Injects GEMINI_API_KEY env var → retries once
4. If retry also fails → propagates error

Available in csa 0.1.201.