fix(ci): defer BigQuery ADC until tool use

Lazy credentials let offline CI import the agent topology without
Application Default Credentials.

Author: samartho4

backend/dry_lab/bq.py

@@ -13,11 +13,41 @@
 from typing import Optional
 
 import google.auth
+import google.auth.credentials
 from google.adk.integrations.bigquery import BigQueryCredentialsConfig, BigQueryToolset
 from google.adk.integrations.bigquery.config import BigQueryToolConfig, WriteMode
 
 from .config import settings
 
+
+class _LazyApplicationDefaultCredentials(google.auth.credentials.Credentials):
+    """Defer google.auth.default until the tool actually needs a token (offline CI can import the agent)."""
+
+    def __init__(self, scopes: list[str]) -> None:
+        self._scopes = scopes
+        self._inner: google.auth.credentials.Credentials | None = None
+        super().__init__()
+
+    def _load(self) -> google.auth.credentials.Credentials:
+        if self._inner is None:
+            self._inner, _ = google.auth.default(scopes=self._scopes)
+        return self._inner
+
+    def __getattr__(self, name: str):
+        if name.startswith("_"):
+            raise AttributeError(name)
+        return getattr(self._load(), name)
+
+    def refresh(self, request) -> None:
+        self._load().refresh(request)
+
+    def apply(self, headers, token=None) -> None:
+        self._load().apply(headers, token=token)
+
+    def before_request(self, request, method, url, headers) -> None:
+        self._load().before_request(request, method, url, headers)
+
+
 _BQ_SCOPES = ["https://www.googleapis.com/auth/bigquery"]
 
 # Keep the agent-facing surface crisp: the investigator only needs to inspect schema + run read-only SELECTs.
@@ -31,7 +61,7 @@ def build_bigquery_toolset(tool_filter: Optional[list[str]] = None) -> BigQueryT
     dataset lives in US on settings.project). Pass tool_filter to scope the exposed tools (e.g. the investigator
     only gets get_table_info + execute_sql so tool selection stays crisp).
     """
-    credentials, _ = google.auth.default(scopes=_BQ_SCOPES)
+    credentials = _LazyApplicationDefaultCredentials(_BQ_SCOPES)
     kwargs = dict(
         credentials_config=BigQueryCredentialsConfig(credentials=credentials),
         bigquery_tool_config=BigQueryToolConfig(