fix(evals): absorb codex/gemini CLI drift; external-service tests go periodic-tier

- codex exec gains --skip-git-repo-check: newer CLIs refuse exec in an
  untrusted non-git dir (our temp skill dirs) — empirically verified.
- gemini: --skip-trust was removed in gemini-cli 0.34 (argv parse error);
  dropped from the session runner and the benchmark adapter. A present-
  but-unusable CLI (deprecated individual code-assist auth path) now
  classifies as SKIP, not a false adapter failure; the benchmark live
  smoke skips on auth/rate_limit error codes (environmental) while still
  failing on timeout/unknown (the drift classes it exists to catch).
- codex-e2e, gemini-e2e, and benchmark-providers gain the canonical
  whole-file EVALS_TIER === 'periodic' guard per CLAUDE.md tiering rule 3
  (external service -> periodic) — the sharded gate runner now excludes
  all three (gate: 45 -> 42 shards).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/helpers/codex-session-runner.ts

@@ -199,8 +199,12 @@ export async function runCodexSkill(opts: {
       }
     }
 
-    // Build codex exec command
-    const args = ['exec', prompt, '--json', '-s', sandbox];
+    // Build codex exec command.
+    // --skip-git-repo-check: newer codex CLIs refuse exec in an untrusted
+    // non-git directory ("Not inside a trusted directory and
+    // --skip-git-repo-check was not specified") — our temp skill dirs are
+    // exactly that. Empirically verified against codex on this machine.
+    const args = ['exec', prompt, '--json', '-s', sandbox, '--skip-git-repo-check'];
 
     // Spawn codex with temp HOME so it discovers our installed skill.
     // Hermetic scrub (test/helpers/hermetic-env.ts) with codex's auth surface

test/helpers/gemini-session-runner.ts

@@ -8,8 +8,8 @@
  * Key differences from Codex session-runner:
  * - Uses `gemini -p` instead of `codex exec`
  * - Output is NDJSON with event types: init, message, tool_use, tool_result, result
- * - Uses `--output-format stream-json --yolo --skip-trust` instead of `--json -s read-only`
- *   (`--skip-trust` required for headless/untrusted cwds; see gemini trusted-folders docs)
+ * - Uses `--output-format stream-json --yolo` instead of `--json -s read-only`
+ *   (`--skip-trust` was removed in gemini-cli 0.34; folder trust is settings-driven now)
  * - No temp HOME needed — Gemini discovers skills from `.agents/skills/` in cwd
  * - Message events are streamed with `delta: true` — must concatenate
  */
@@ -121,10 +121,11 @@ export async function runGeminiSkill(opts: {
     };
   }
 
-  // Build gemini command
-  // --skip-trust: headless/CI and temp cwds aren't in ~/.gemini/trustedFolders.json;
-  // without it gemini exits FatalUntrustedWorkspaceError before any model call.
-  const args = ['-p', prompt, '--output-format', 'stream-json', '--yolo', '--skip-trust'];
+  // Build gemini command.
+  // --skip-trust was REMOVED in gemini-cli 0.34 ("Unknown arguments:
+  // skip-trust"); folder trust moved to settings and no longer needs a flag
+  // for headless runs. --yolo still auto-approves tool actions.
+  const args = ['-p', prompt, '--output-format', 'stream-json', '--yolo'];
 
   // Spawn gemini — uses real HOME for auth (~/.gemini; HOME is allowlisted),
   // cwd for skill discovery. Hermetic scrub with gemini's auth surface
@@ -198,6 +199,31 @@ export async function runGeminiSkill(opts: {
     process.stderr.write(`  [gemini stderr] ${stderr.trim().slice(0, 200)}\n`);
   }
 
+  // Environment-unusable classification: these are Google-side conditions no
+  // test assertion can act on — the deprecated individual code-assist auth
+  // path ("migrate to the Antigravity suite") and argv drift on older/newer
+  // CLIs. Return the same SKIP shape as binary-not-found so callers report
+  // SKIPPED instead of a false FAIL.
+  const unusableMarkers = [
+    'no longer supported for Gemini Code Assist',
+    'antigravity',
+    'Unknown arguments: skip-trust',
+  ];
+  if (exitCode !== 0 && parsed.tokens === 0) {
+    const marker = unusableMarkers.find((m) => stderr.toLowerCase().includes(m.toLowerCase()));
+    if (marker) {
+      return {
+        output: `SKIP: gemini CLI unusable (${marker})`,
+        toolCalls: [],
+        tokens: 0,
+        exitCode: -1,
+        durationMs,
+        sessionId: null,
+        rawLines: collectedLines,
+      };
+    }
+  }
+
   return {
     output: parsed.output,
     toolCalls: parsed.toolCalls,

test/helpers/providers/gemini.ts

@@ -103,10 +103,10 @@ export function resultFromGeminiStream(
  * Headless flags always passed:
  *   --output-format stream-json  — NDJSON events (message/tool_use/result)
  *   --yolo                       — auto-approve tools (non-interactive)
- *   --skip-trust                 — trust cwd for this session; required when
- *                                  workdir is a temp/untrusted folder (benchmarks
- *                                  use mkdtemp). Without it headless gemini exits
- *                                  before calling the model.
+ *
+ * --skip-trust is gone: gemini-cli 0.34 removed the flag ("Unknown arguments:
+ * skip-trust") — folder trust is settings-driven now and headless runs no
+ * longer need a flag for temp workdirs.
  */
 export class GeminiAdapter implements ProviderAdapter {
   readonly name = 'gemini';
@@ -136,10 +136,9 @@ export class GeminiAdapter implements ProviderAdapter {
   async run(opts: RunOpts): Promise<RunResult> {
     const start = Date.now();
     // Default to --yolo (non-interactive) and stream-json output so we can parse
-    // tokens + tool calls. --skip-trust is required for headless/temp workdirs
-    // (gemini CLI otherwise exits: "not running in a trusted directory").
-    // Callers can override via extraArgs.
-    const args = ['-p', opts.prompt, '--output-format', 'stream-json', '--yolo', '--skip-trust'];
+    // tokens + tool calls. Callers can override via extraArgs. (--skip-trust was
+    // removed in gemini-cli 0.34; passing it errors at argv parse.)
+    const args = ['-p', opts.prompt, '--output-format', 'stream-json', '--yolo'];
     if (opts.model) args.push('--model', opts.model);
     if (opts.extraArgs) args.push(...opts.extraArgs);