Adds a native Gemini CLI AfterAgent extension that checks the proposed response with Hermeneutic’s deterministic drift gate and requests one bounded automatic retry for medium- or high-risk output. The extension was exercised from a clean copied install against Gemini CLI 0.32.1; malformed input and internal failures remain explicitly fail-open. The source distribution now includes the complete Gemini extension contract.