ci(ag-ui): bake GOOGLE_MAPS_API_KEY + Map ID into the demo deploy build

[blove]

What

The App-mode map cockpit (#747) is invisible on the deployed demo: the ag-ui-demo-deploy job builds with no Maps env, so inject-env bakes an empty key into the bundle — verified against prod (ag-ui.threadplane.ai main-*.js ships googleMaps:""), which disables the App-mode toggle.

This passes GOOGLE_MAPS_API_KEY (new repo secret) and the non-secret Map ID (86d464ea7d5306034fe2a254) to the assemble step.

Required follow-ups (not in this PR)

1. Add the repo secret (owner action): gh secret set GOOGLE_MAPS_API_KEY with the key from the root .env.
2. Re-add HTTP-referrer restrictions on the key in Google Cloud console (they were removed during local debugging): https://ag-ui.threadplane.ai/* + http://localhost:*. The key ships in the public bundle, so referrer restriction is the security boundary.
3. Rollout: the deploy job only fires when examples/ag-ui/** changes — the next ag-ui PR to land (e.g. feat(ag-ui): context-aware welcome suggestions (App mode leads with itinerary prompts) #746) will roll the key-enabled bundle out.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
threadplane	Ready	Preview, Comment	Jul 6, 2026 3:08pm

[github-actions]

Automated approval: this PR received an intelligent (AI) code review. See the review comments on this PR.

[github-actions]

Claude finished @blove's task in 1m 31s —— View job

---

PR Review

• Gather context
• Read CI workflow diff
• Review for security, correctness, and workflow injection issues
• Post findings

---

This change is correct. The 7-line diff does exactly what it says: scopes GOOGLE_MAPS_API_KEY and GOOGLE_MAPS_MAP_ID as env vars on the build step so that inject-env.mjs can bake them into the Angular production bundle.

Here's the full chain I verified:

1. CI env: → process.env — the vars are on the run: npx tsx scripts/assemble-ag-ui-demo.ts step, so they're available to every child process it spawns.
2. assemble script → nx build — assemble-ag-ui-demo.ts:49 runs npx nx build examples-ag-ui-angular --configuration=production --skip-nx-cache.
3. nx build → inject-env dependency — project.json lists inject-env as a dependsOn target for the production build.
4. inject-env reads process.env — inject-env.mjs:21 merges .env file (absent in CI) with process.env; your new vars win.
5. bakes into bundle — writes generated-keys.local.ts which Angular swaps in via fileReplacements.

--skip-nx-cache on the build call ensures inject-env always re-runs and never returns a stale cached empty key.

No issues found:

• No script injection risk. ${{ secrets.GOOGLE_MAPS_API_KEY }} is in an env: block, not interpolated into a shell script, so GitHub Actions handles masking and escaping safely.
• Map ID hardcoded correctly. 86d464ea7d5306034fe2a254 is a non-secret Map ID; storing it in a repo secret would be unnecessary. The comment documents this explicitly.
• Env scoped to the right step. The Vercel deploy step only consumes prebuilt artifacts and doesn't need these vars.

One thing to be aware of (already documented in the PR body): if the GOOGLE_MAPS_API_KEY repo secret hasn't been added before the next deploy fires, inject-env will silently bake an empty key — same as the current broken state. The follow-up secret-add is load-bearing for this to actually work.