[e2e] cover unversioned Vertex models, versioned config ids, and count-tokens

Extend the agent-network e2e to the Vertex request shapes a customer
actually sends through Claude Code:

- Register the Vertex provider's model under the raw "@version" id the
  Google console documents, so the router's candidate normalization is
  exercised end to end (previously the provider was created with no
  models array, leaving Vertex per-provider matching untested).
- Allowlist the raw "@version" id in the guardrail, so entry
  normalization is exercised against version-stripped request models.
- Drive the unversioned model id (…/models/claude-sonnet-4-5:rawPredict)
  through the tunnel and require 200 — the customer-reported shape.
- Drive the token-count endpoint (…/models/count-tokens:rawPredict, real
  model in the body) via the new harness VertexCountTokens: an
  allowlisted body model must serve 200, a disallowed one must deny 403
  before the upstream.

e2e/agentnetwork/guardrail_test.go

@@ -125,7 +125,13 @@ func TestModelAllowlistEnforced(t *testing.T) {
 		require.NoError(t, perr, "create provider %s", pc.name)
 		id := prov.Id
 		ids = append(ids, id)
-		allowed = append(allowed, catalogModel(pc))
+		// Vertex allowlists the raw "@version" id (the guardrail normalizes it);
+		// other providers allowlist the normalized catalog id.
+		if pc.kind == harness.WireVertex {
+			allowed = append(allowed, pc.model)
+		} else {
+			allowed = append(allowed, catalogModel(pc))
+		}
 		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
 	}
 
@@ -182,6 +188,22 @@ func TestModelAllowlistEnforced(t *testing.T) {
 			// the upstream), regardless of whether it is a real catalog model.
 			assert.Equal(t, 403, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, disallowedModel(pc)),
 				"model outside the allowlist must be denied for %s", pc.name)
+
+			if pc.kind != harness.WireVertex {
+				return
+			}
+			// Unversioned model id (the customer-reported shape) must pass the
+			// same allowlist entry.
+			assert.Equal(t, 200, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, catalogModel(pc)),
+				"unversioned model id must be permitted for %s", pc.name)
+			// count-tokens carries the real model in the body: allowed → served.
+			code, _, err := cl.VertexCountTokens(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model)
+			require.NoError(t, err, "count-tokens request must reach the proxy for %s", pc.name)
+			assert.Equal(t, 200, code, "count-tokens with an allowlisted body model must be permitted for %s", pc.name)
+			// Disallowed body model → denied before the upstream.
+			code, _, err = cl.VertexCountTokens(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, disallowedModel(pc))
+			require.NoError(t, err, "count-tokens request must reach the proxy for %s", pc.name)
+			assert.Equal(t, 403, code, "count-tokens with a body model outside the allowlist must be denied for %s", pc.name)
 		})
 	}
 }