fix: follow redirects when downloading skills in GcpSkillRegistry

[codebee-aoki]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: N/A
• Related: N/A

2. Or, if no issue exists, describe the change:

Problem:
GcpSkillRegistry.get_skill() fails when downloading the skill archive. The Agent Registry API serves the revision media download (?alt=media) as a 302 redirect to a GCS signed URL. The httpx.AsyncClient created in _create_httpx_client does not follow redirects (httpx default), and response.raise_for_status() raises on 3xx, so the request surfaces as RuntimeError: API request failed with status 302: ....

Solution:
Pass follow_redirects=True to both httpx.AsyncClient constructions in _create_httpx_client (the plain client and the mTLS/ssl-context client).

Following redirects is safe here: httpx removes the Authorization header when following a redirect to a different origin, so the OAuth bearer token is not leaked to the GCS signed-URL host (GCS would reject a signed URL carrying extra credentials anyway).

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

Added a unit test (test_create_httpx_client_follows_redirects) asserting that clients created by _create_httpx_client have follow_redirects=True, for both the default branch and the mTLS/ssl-context branch. Also updated an existing assertion (test_get_skill_with_mtls) that checked the exact httpx.AsyncClient constructor kwargs, since it now includes follow_redirects=True.

$ pytest tests/unittests/integrations/skill_registry/test_gcp_skill_registry.py -q
23 passed in 3.58s

Manual End-to-End (E2E) Tests:

Tested end-to-end by applying the identical change (monkey-patching GCPSkillRegistry._create_httpx_client to pass follow_redirects=True, same two-branch logic as this PR) to an agent deployed on Agent Engine runtime. Confirmed that skill downloads from the Agent Registry — which previously failed with RuntimeError: API request failed with status 302: ... — now succeed: the ?alt=media request's 302 redirect to the GCS signed URL is followed and the skill archive is downloaded and loaded correctly.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.

Additional context

None.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[codebee-aoki]

@googlebot I signed it!

[doublenum]

Confirming this reproduces against a real Agent Registry catalog on google-adk 2.7.1: every SkillToolset.load_skill fails with the 302 on the ?alt=media media download, and we have been running exactly this fix (follow_redirects=True in _create_httpx_client, both branches) as a client-side monkey-patch in production since 2.6.2 — it fully restores skill loading. Would be glad to see this merged so we can drop the local patch. Related: filed #6838 for the neighboring search_skills per-item validation crash.