fix(plugin-sdk): bound Anthropic Vertex ADC credential read (#111120)

* fix(plugin-sdk): bound Anthropic Vertex ADC credential read

canReadAnthropicVertexAdc read the entire GOOGLE_APPLICATION_CREDENTIALS
file via unbounded fs.readFileSync solely to check readability (the
contents are discarded). The provider-local copy of this logic in
extensions/anthropic-vertex/region.ts was already bounded with
tryReadSecretFileSync + a 1 MiB limit in #109260 ("reject oversized
credential files in remaining readers"); this standalone plugin-sdk
preflight helper is a duplicate that sweep missed.

Mirror the region.ts bound: replace the unbounded readFileSync with
tryReadSecretFileSync(..., { maxBytes: 1 MiB, rejectHardlinks: false }),
wrapped in try/catch (the helper throws FsSafeError on oversize) so an
oversized credential file is rejected instead of slurped into memory.
Presence-check semantics are unchanged for normal-sized files.

* refactor(plugin-sdk): remove orphaned vertex auth helper

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>

src/scripts/test-projects.test.ts

@@ -225,11 +225,11 @@ describe("test-projects args", () => {
   });
 
   it("routes plugin-sdk targets to the plugin-sdk config", () => {
-    expect(buildVitestRunPlans(["src/plugin-sdk/anthropic-vertex-auth-presence.test.ts"])).toEqual([
+    expect(buildVitestRunPlans(["src/plugin-sdk/migration-runtime.test.ts"])).toEqual([
       {
         config: "test/vitest/vitest.plugin-sdk.config.ts",
         forwardedArgs: [],
-        includePatterns: ["src/plugin-sdk/anthropic-vertex-auth-presence.test.ts"],
+        includePatterns: ["src/plugin-sdk/migration-runtime.test.ts"],
         watchMode: false,
       },
     ]);