The human did not want a Gemini API key, even one Terraform would keep. The tie-breaker calls Gemini 2.5 Flash through Vertex AI on the worker’s service account, and the reconciler is always provisioned. The model is still Gemini. The key is not.