fix: resolve all 17 playbook findings (P0–P3)

P0 fixes:
- agent register: upsert by agent_id (no duplicate rows)
- daemon poll-once: extract _gmail_poll_cycle, run synchronously
- garc_core.py: suppress urllib3/googleapiclient DeprecationWarnings

P1 fixes:
- OAuth: detect RefreshError → delete stale token → re-auth flow
- OAuth: scope coverage check before returning valid creds
- ingress: add stale-reset subcommand (reset in_progress > N min)
- sheets: trim-sheet / clean-all — deleteDimension for empty rows
- approval gate: send Gmail notification to GARC_APPROVAL_EMAIL

P2 additions:
- Google Chat: garc-chat-helper.py + garc send chat subcommands
- Service Account: garc auth service-account verify + DWD support
- Audit log: Sheets audit tab + garc audit list + bin/garc async hook
- garc auth revoke: POST /revoke + delete token file
- kg: pagination fix, shell injection fix, garc-kg-query.py
- docs: _doc_insert_text / append_doc / garc drive append-doc

P3 additions:
- Multi-tenant: lib/profile.sh (list/use/add/show/remove/current)
  bin/garc: auto-load profile config.env and token.json
- Google Forms pipeline: garc-forms-helper.py + lib/forms.sh
  garc forms list/responses/watch
- systemd: _daemon_install_service OS-detect → launchd or systemd units
- Python version gate (>=3.10) in bin/garc + pyproject.toml
- garc doctor command for environment diagnostics

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/config.env.example

@@ -28,8 +28,19 @@ GARC_TOKEN_FILE=~/.garc/token.json
 # Service account JSON file (for bot/automated operations)
 # GARC_SERVICE_ACCOUNT_FILE=~/.garc/service_account.json
 
+# Domain-wide Delegation: impersonate this user when using a service account
+# Requires DWD to be enabled in Google Workspace Admin Console
+# GARC_IMPERSONATE_EMAIL=user@yourdomain.com
+
 # Default agent ID
 GARC_DEFAULT_AGENT=main
 
 # Cache directory
 GARC_CACHE_DIR=~/.garc/cache
+
+# Approval gate: email address to notify when an item requires human approval
+# If unset, approval notifications are skipped (item is still blocked in queue)
+GARC_APPROVAL_EMAIL=approver@example.com
+
+# Auto-confirm preview gate in non-interactive mode (daemon/CI use only)
+GARC_AUTO_CONFIRM=false