fix(translator): prevent schema property name collision in Gemini sanitizer (#13057, #13477)

[zcrew0x]

Fixes #13057
Closes #13477
Supersedes #13059 (rebased onto release/v3.8.51 with regression test for delivery.pin.required)

Problem

When a tool parameter schema contains a property named "properties", "required", etc. (e.g. in Roblox Studio, Blender, JSON Patch, or delivery.pin from #13477):

{
  "type": "object",
  "properties": {
    "action": { "type": "string" },
    "properties": { "type": "array", "items": { "type": "string" } }
  },
  "required": ["action"]
}

Schema visitor functions in open-sse/translator/helpers/geminiHelper.ts (such as injectObjectType, addPlaceholders, cleanupRequired, etc.) traversed schemas by doing a blind for (const value of Object.values(record)). When visiting schema.properties, because record.type was undefined and record.properties (or record.required) existed, injectObjectType injected schema.properties.type = "object" directly into the property dictionary.

This corrupted the schema sent to Google CloudCode/Gemini:

{
  "type": "object",
  "properties": {
    "action": { "type": "string" },
    "properties": { "type": "array", "items": { "type": "string" } },
    "type": "object"  <-- Invalid schema property
  }
}

Google rejected the request with HTTP 400:

"Invalid value at 'request.tools[0].function_declarations[1].parameters.properties[2].value' (type.googleapis.com/google.cloud.aiplatform.master.Schema), 'object'"

Solution

1. Introduce forEachSubschema in geminiHelper.ts to traverse subschemas according to JSON Schema structure (descending into values of properties, patternProperties, $defs, definitions rather than treating the container maps as schema nodes).
2. Use forEachSubschema across all schema visitors in geminiHelper.ts (injectObjectType, addPlaceholders, cleanupRequired, normalizeAdditionalProperties, convertConstToEnum, convertEnumValuesToStrings, mergeAllOf, flattenAnyOfOneOf, and flattenTypeArrays).
3. Add regression unit test suite in tests/unit/gemini-schema-properties-name-collision-13057.test.ts covering both property named "properties" (fix(providers): Gemini schema sanitizer corrupts tools containing property named 'properties' (HTTP 400) & keepalive chunk desync in AI-SDK #13057) and property named "required" ([BUG] Antigravity (AGY) Provider Returns 400 Bad Request - Schema Incompatibility with Google Gemini Tools #13477).

[diegosouzapw]

Thanks for the thorough fix — verified the regression test passes clean at your
head (2/2), and confirmed the underlying bug (properties-map-as-schema-node) is
still live on the current release tip across every visitor function you touched,
not just injectObjectType. This is the most complete fix in the batch: it also
closes #13477 (delivery.pin) which a narrower competing fix does not actually
reproduce.

Two small asks before merge: (1) add a changelog.d/fixes/ fragment — none is
included; (2) SCHEMA_MAP_KEYS already exists in this same file (from #12269)
with the canonical list of schema-map keys including dependentSchemas, which
your new forEachSubschema() doesn't check — reusing that constant instead of
the hand-rolled list would close that last gap and avoid a second source of
truth for the same concept.

[zcrew0x]

@diegosouzapw Thank you for the review! I've updated the PR with both requested changes:

1. Reused the canonical SCHEMA_MAP_KEYS constant in forEachSubschema(), covering dependentSchemas and removing duplication.
2. Added the changelog fragment at changelog.d/fixes/13690-gemini-schema-properties-name-collision.md (verified dry-run aggregation).

[diegosouzapw]

Thanks @zcrew0x — merging via the release merge-train. Validated in local merge-train (merge-train-20260918-120911-suite.log) on the devbox @ train tip 8c305709478b7052fb981a75852bbf88fe3a959d with the sibling PRs of this batch: typecheck:core, file-size, complexity, cognitive-complexity, changelog-integrity green; changed-area node:test 310/311 (the single red, hard-lease inventory, reproduces on the pure release tip) + vitest green (fast parity mode — full suite ran today on the tip via the base-red and 3b trains). Merged --admin per merge-gates §4/§7.