Switch Gmail and Gcal to env-var OAuth delivery pattern

auth.deliver changes from as:file to as:env:
- Gmail: GMAIL_CREDS_JSON env var (Google authorized_user JSON)
- Gcal: GCAL_CREDS_JSON env var

mcp_config.env removed entirely — Skald injects the env var at runtime,
no path on disk needed.

Server scripts updated:
- Check GMAIL_CREDS_JSON / GCAL_CREDS_JSON env var first
- Use Credentials.from_authorized_user_info() instead of
  from_authorized_user_file()
- Fall back to file-based loading for standalone/legacy use
- _persist_creds only writes to disk when _creds_path is set

gcal/verify.py: support GCAL_CREDS_JSON env var with shared _check_api()

Docs (SKALD.md): updated examples, field table, connector table.

connectors/gcal/gcal_mcp_server.py

@@ -11,14 +11,13 @@ Capabilities (callable as `mcp__gcal__<tool>`):
   delete_event    — permanently delete an event
   respond_to_event — set RSVP / attendance response
 
-Credentials are read from ./secrets/google_creds.json by default.
-Override with GOOGLE_CREDS_PATH env var.
+Skald mode: Skald injects credentials via GCAL_CREDS_JSON env var (authorized_user JSON).
+Standalone mode: reads from GOOGLE_CREDS_PATH or ./secrets/google_creds.json.
+Run scripts/gcal_oauth_setup.py to (re-)authenticate (standalone).
 
 Required OAuth scopes:
   https://www.googleapis.com/auth/calendar
   (or https://www.googleapis.com/auth/calendar.events for events-only)
-
-Run scripts/gcal_oauth_setup.py to (re-)authenticate.
 """
 
 from __future__ import annotations
@@ -138,7 +137,14 @@ def _persist_creds() -> None:
 
 
 def _build_service() -> Any:
-    """Build and return a Google Calendar service object, or None on failure."""
+    """Build and return a Google Calendar service object, or None on failure.
+
+    Credentials are loaded in priority order:
+    1. GCAL_CREDS_JSON env var — full authorized_user JSON injected by Skald
+       (Credentials.from_authorized_user_info)
+    2. GOOGLE_CREDS_PATH env var → file on disk (standalone/legacy)
+    3. Default path ./secrets/google_creds.json (standalone use)
+    """
     global _init_error, _creds, _creds_path
     try:
         from google.auth.transport.requests import Request
@@ -149,25 +155,40 @@ def _build_service() -> Any:
         log(_init_error)
         return None
 
-    _creds_path = os.environ.get(
-        "GOOGLE_CREDS_PATH",
-        os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "secrets", "google_creds.json"),
-    )
+    _SCOPES = [
+        "https://www.googleapis.com/auth/calendar",
+    ]
 
-    if not os.path.exists(_creds_path):
-        _init_error = (
-            f"Credentials file not found at {_creds_path}. "
-            "Run scripts/gcal_oauth_setup.py to authenticate, or set GOOGLE_CREDS_PATH."
+    raw = os.environ.get("GCAL_CREDS_JSON")
+    if raw:
+        try:
+            creds = Credentials.from_authorized_user_info(json.loads(raw), _SCOPES)
+            _creds_path = None  # no file, persisted only in env
+            log("Credentials loaded from GCAL_CREDS_JSON env var.")
+        except Exception as e:
+            _init_error = f"Failed to load credentials from GCAL_CREDS_JSON: {e}"
+            log(_init_error)
+            return None
+    else:
+        _creds_path = os.environ.get(
+            "GOOGLE_CREDS_PATH",
+            os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "secrets", "google_creds.json"),
         )
-        log(_init_error)
-        return None
 
-    try:
-        creds = Credentials.from_authorized_user_file(_creds_path)
-    except Exception as e:
-        _init_error = f"Failed to load credentials from {_creds_path}: {e}"
-        log(_init_error)
-        return None
+        if not os.path.exists(_creds_path):
+            _init_error = (
+                f"Credentials not found. Set GCAL_CREDS_JSON env var (Skald mode) or "
+                f"place credentials file at {_creds_path} (standalone mode)."
+            )
+            log(_init_error)
+            return None
+
+        try:
+            creds = Credentials.from_authorized_user_file(_creds_path)
+        except Exception as e:
+            _init_error = f"Failed to load credentials from {_creds_path}: {e}"
+            log(_init_error)
+            return None
 
     # Publish creds globally so _persist_creds / _call can see them.
     _creds = creds
@@ -176,7 +197,8 @@ def _build_service() -> Any:
     if creds.expired and creds.refresh_token:
         try:
             creds.refresh(Request())
-            _persist_creds()
+            if _creds_path:
+                _persist_creds()
             log("Token refreshed and saved.")
         except Exception as e:
             log(f"Token refresh failed: {e}")
@@ -188,7 +210,7 @@ def _build_service() -> Any:
         log(_init_error)
         return None
 
-    log(f"Calendar service built successfully (creds: {_creds_path})")
+    log(f"Calendar service built successfully (creds: env var or {_creds_path})")
     return service
 
 
@@ -319,8 +341,8 @@ def _gcal_status(args: dict | None = None) -> str:
     if svc is None:
         return _status_report("❌", "NOT_CONFIGURED", "action needed",
             f"The Google Calendar service could not be built: {_init_error or 'unknown error'}.",
-            ["Run scripts/gcal_oauth_setup.py to authenticate and create secrets/google_creds.json.",
-             "Or set the GOOGLE_CREDS_PATH env var to point at an existing credentials file."])
+            ["Run scripts/gcal_oauth_setup.py to authenticate (standalone).",
+             "For Skald mode, ensure GCAL_CREDS_JSON env var is set."])
 
     # Step 2: live probe — refresh-on-auth-error is handled inside _call.
     try: