hermes - 💡(How to fix) Fix google-workspace: strengthen OAUTH_CLIENT_DISABLED output — banner + appeal-first ordering

Context

Follow-up to #19570 / PR #19643. When check_auth() detects disabled_client/invalid_client in the OAuth refresh path, the shipped code prints a plain 5-line guidance block:

OAUTH_CLIENT_DISABLED: <exception repr>
  The OAuth client or Google account has been disabled.
  Steps to resolve:
    1. Check your Google Cloud Console — verify the OAuth client is not disabled
    2. Check if your Google account itself has been disabled at myaccount.google.com
    3. If the account is disabled, you can appeal at accounts.google.com/signin/recovery
    4. Do NOT retry API calls with a disabled account — this may worsen the situation
    5. If the OAuth client is disabled, create a new one in Google Cloud Console

Problem

This is the single most severe state setup.py can report — the user's Google account may be permanently gone, and aggressive retries can reduce the chance of a successful appeal. But the current output:

• Blends into normal print() activity in the CLI, the agent's tool-call stream, and gateway platforms (Telegram, Discord, Slack).
• Doesn't visually distinguish itself from benign REFRESH_FAILED: output.
• Buries the "do NOT retry" line as bullet point 4.
• Buries the appeal URL, which is time-sensitive (Google deletion timelines for disabled accounts are tight).

A user skim-reading the agent's output may not register that they need to stop and appeal now rather than retry setup.

Proposed fix

Wrap the OAUTH_CLIENT_DISABLED message in a strong visual delimiter, and lead with the two actions that matter in the first 10 seconds of reading:

============================================================
⚠️  OAUTH_CLIENT_DISABLED — STOP AND READ
============================================================
<exception repr>

The OAuth client or Google account has been disabled by Google.

DO THIS NOW:
  1. Appeal the account at https://accounts.google.com/signin/recovery
     (time-sensitive — disabled accounts can be permanently deleted).
  2. Do NOT retry API calls; repeated failures from a disabled account
     can reduce appeal success.

THEN DIAGNOSE:
  - Check OAuth client status: https://console.cloud.google.com/apis/credentials
  - Check account status:      https://myaccount.google.com
  - If only the OAuth CLIENT is disabled (not the account), create a new
    one in Cloud Console and re-run setup.
============================================================

Same information, reordered so the "appeal now / don't retry" actions come before the diagnostic steps. The banner makes it hard to miss in any rendering context.

Acceptance criteria

• OAUTH_CLIENT_DISABLED output uses a delimiter banner.
• Appeal URL and "do not retry" guidance moved to the top of the action list.
• No time-sensitive specifics (account deletion dates, appeal deadlines) in the output — those change.
• Minor: apply the same banner treatment to LIVE_CHECK_FAILED: OAuth client or account disabled in check_auth_live() for consistency.

Non-goals

• Do NOT add a specific deletion date (e.g. "scheduled for deletion on Mar 30, 2027" from the issue comment on #19570) to the script output. Dates go stale and could mislead a panicked user into missing their appeal window.

References

• Original PR: #19643 (closed, salvaged as 5fa493a2c + 83c23e886)
• Issue: #19570

Related

Natural candidate to bundle with #21860, #21861, and #21862 into a single "harden google-workspace setup.py error handling" PR.