feat(cli): Support custom service accounts for Agent Engine deploy - #6702

Summary

Implements custom runtime service account support for adk deploy agent_engine (#2951).

Why this is needed

Using a dedicated least-privilege service account is Cloud IAM best practice for Agent Engine. Today adk deploy agent_engine always falls back to the default Agent Engine service agent — there is no first-class CLI/config way to set the runtime identity that Vertex documents for Agent Engine deploy.

The Vertex Agent Engine SDK already accepts config.service_account → spec.service_account. ADK just never exposed it.

What we did

• Added --service_account to adk deploy agent_engine
• Accepted the same value from:
  • .agent_engine_config.json ("service_account": "...")
  • .env (GOOGLE_CLOUD_SERVICE_ACCOUNT=..., popped so it is not leaked into runtime env_vars)
• Validated email format early with a clear error
• Precedence: CLI > config file / .env (CLI wins)
• Forwarded as top-level agent_config["service_account"] on client.agent_engines.update(...) (runtime identity — distinct from build_config.service_account used for Cloud Build)

How it fits

adk deploy agent_engine --service_account=my-agent@proj.iam.gserviceaccount.com
        │
        ▼
to_agent_engine(... service_account=...)
        │
        ▼
agent_config["service_account"] = <email>
        │
        ▼
vertexai.Client().agent_engines.update(config=agent_config)
        │
        ▼
Agent Engine runs as the custom runtime SA

Usage

adk deploy agent_engine \
  --project=my-project \
  --region=us-central1 \
  --service_account=my-agent@my-project.iam.gserviceaccount.com \
  my_agent

Or in .agent_engine_config.json:

{
  "service_account": "my-agent@my-project.iam.gserviceaccount.com"
}

Or in .env:

GOOGLE_CLOUD_SERVICE_ACCOUNT=my-agent@my-project.iam.gserviceaccount.com

Verification

• Confirmed not previously implemented on main
• Confirmed SDK mapping: config.service_account → spec.service_account
• Unit tests for validation, CLI/config/.env sources, env-var non-leakage, and update-config forwarding
• uv run pytest tests/unittests/cli/utils/test_cli_deploy.py → 60 passed

Fixes #2951

Test plan

• Unit tests for _validate_service_account (valid + malformed)
• Unit tests for _apply_service_account_to_agent_config (CLI, config, override)
• to_agent_engine forwards service_account on agent_engines.update
• .env GOOGLE_CLOUD_SERVICE_ACCOUNT is applied and not leaked into env_vars
• CLI --service_account reaches to_agent_engine
• Maintainer review of precedence / naming
• Optional: end-to-end deploy with a custom SA in a GCP project

cc @yeesian @klateefa @wuliang229 @Jacksunwei @llalitkumarrr @GWeale

I claimed this on #2951 (self-assign needs triage permissions — please assign @a2105z if helpful). Ready for review.