Support skipping GCP auth in Vertex AI mode for proxy-based deployments

Problem

When CLAUDE_CODE_USE_VERTEX=1 is set, Claude Code uses @anthropic-ai/vertex-sdk, which depends on google-auth-library. This library runs a full GCP OAuth discovery flow before sending any API request:

1. Checks GOOGLE_APPLICATION_CREDENTIALS
2. Tries the GCE metadata server (169.254.169.254)
3. Looks for ADC (~/.config/gcloud/application_default_credentials.json)

In environments where an infrastructure proxy handles Vertex AI authentication on behalf of the client (e.g., OpenShell sandboxes, corporate API gateways), these Google endpoints are unreachable or intentionally blocked. The auth discovery hangs indefinitely, making native Vertex mode unusable — even though the proxy already injects valid GCP credentials before forwarding to Vertex AI.

Workaround

Today the only option is to avoid Vertex mode entirely and instead set ANTHROPIC_BASE_URL to the proxy endpoint, forcing Claude Code into first-party Anthropic API mode. The proxy then translates /v1/messages requests into Vertex rawPredict format. This works but means the proxy must maintain a translation layer, and any new Anthropic SDK body fields (e.g., context_management in 2.1.x) can break the translation since Vertex schema-validates and rejects unknown fields.

Proposed Solution

Add a flag to skip GCP authentication while still using the Vertex API format:

export CLAUDE_CODE_USE_VERTEX=1
export CLOUD_ML_REGION=us-east5
export ANTHROPIC_VERTEX_PROJECT_ID=my-project
export ANTHROPIC_VERTEX_BASE_URL=https://my-proxy.local
export ANTHROPIC_VERTEX_SKIP_AUTH=1  # don't run GCP OAuth discovery

This would tell the SDK to construct Vertex-format requests (rawPredict URLs, correct body shape) but send them without an Authorization header, leaving auth to the proxy.

Use Cases

• Sandboxed environments (OpenShell, etc.) where network access is restricted and a gateway proxy handles Vertex AI auth
• Corporate API gateways that centralize GCP credential management and inject auth headers on behalf of clients
• CI/CD pipelines where short-lived tokens are available but full ADC/metadata infrastructure is not