fix(cli): consume AGENT_GATEWAY_ROOT_CERTIFICATES in deploy Dockerfile

[Solaris-star]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: Dockerfile from "adk deploy agent_engine" ignores "AGENT_GATEWAY_ROOT_CERTIFICATES" build arg, causing runtime SSL handshake failures #6427

2. Or, if no issue exists, describe the change:

Problem:
adk deploy agent_engine (and the shared Dockerfile template used by Cloud Run / GKE deploy paths) never declared or consumed the AGENT_GATEWAY_ROOT_CERTIFICATES build-arg that Cloud Build passes for Agent Gateway TLS interception. Outbound HTTPS/gRPC through the gateway then fails with CERTIFICATE_VERIFY_FAILED.

Solution:
Add an optional ARG AGENT_GATEWAY_ROOT_CERTIFICATES + root-only RUN that writes the cert into /usr/local/share/ca-certificates/ and runs update-ca-certificates before switching to the non-root user. Empty arg remains a no-op.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

Extended tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py assertions for ARG AGENT_GATEWAY_ROOT_CERTIFICATES and update-ca-certificates. Also ran a lightweight template-format check confirming the ARG block is emitted before USER myuser. Full package pytest not run in this environment (host missing project deps); CI should cover deploy unit tests.

Manual End-to-End (E2E) Tests:

Not run here (requires Cloud Build + Agent Gateway). The change is limited to Dockerfile generation; when Cloud Build passes the build-arg it is now consumed instead of warning "build-args were not consumed".

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.

Additional context

Suggested Dockerfile snippet from the issue is followed; install runs as root before USER myuser.

[rohityan]

Hi @Solaris-star , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Your PR has been received by the team and is currently under review. We will provide feedback as soon as we have an update to share.

[rohityan]

Hi @sasha-gitg , can you please review this. LGTM