feat(cli): Support Cloud Build worker pools for Agent Engine deploy - #6701

Summary

Implements Cloud Build private worker pool support for adk deploy agent_engine (#2141).

Why this is needed

Enterprise / VPC-SC Agent Engine deploys often cannot use the default public Cloud Build pool. Without a way to point the build at a private worker pool, adk deploy agent_engine fails for teams that require private networking, org build policies, or connectivity to private resources.

The Vertex Agent Engine SDK already accepts this via config.build_config.worker_pool → spec.build_spec.worker_pool, but ADK never exposed it on the CLI or documented a first-class config key.

What we did

• Added --worker_pool to adk deploy agent_engine
• Accepted the same value from .agent_engine_config.json as either:
  • top-level "worker_pool": "projects/.../workerPools/..." (convenience), or
  • "build_config": {"worker_pool": "..."} (native SDK shape)
• Nested the value into agent_config["build_config"]["worker_pool"] before client.agent_engines.update(...)
• Validated the Cloud Build resource name format early with a clear error
• Preserved other build_config fields (e.g. build service_account)
• CLI flag overrides config-file values (same pattern as display_name)

How it fits

adk deploy agent_engine --worker_pool=...
        │
        ▼
to_agent_engine(... worker_pool=...)
        │
        ▼
agent_config["build_config"]["worker_pool"] = <resource name>
        │
        ▼
vertexai.Client().agent_engines.update(config=agent_config)
        │
        ▼
Cloud Build runs on the private worker pool

Usage

adk deploy agent_engine \
  --project=my-project \
  --region=us-central1 \
  --worker_pool=projects/my-project/locations/us-central1/workerPools/my-private-pool \
  my_agent

Or in .agent_engine_config.json:

{
  "worker_pool": "projects/my-project/locations/us-central1/workerPools/my-private-pool"
}

Verification

• Confirmed worker_pool was not previously implemented in ADK (rg / deploy path audit)
• Confirmed Vertex SDK mapping in vertexai/_genai/agent_engines.py (build_config.worker_pool → spec.build_spec.worker_pool)
• Added unit tests for validation, config nesting, CLI passthrough, and deploy config forwarding
• uv run pytest tests/unittests/cli/utils/test_cli_deploy.py → 60 passed

Fixes #2141

Test plan

• Unit tests for _validate_worker_pool (valid + malformed)
• Unit tests for _apply_worker_pool_to_agent_config (CLI, config top-level, override, preserve other build_config fields)
• to_agent_engine forwards build_config.worker_pool on agent_engines.update
• CLI --worker_pool reaches to_agent_engine
• Maintainer review of CLI naming / config-file shape
• Optional: end-to-end deploy against a real private worker pool in a VPC-SC project

cc @klateefa @yeesian @wuliang229 @Jacksunwei @hangfei @llalitkumarrr @GWeale

I claimed this on #2141 (self-assign needs triage permissions — please assign me @a2105z if that helps routing). Ready for review whenever you have a moment.