live.connect() (Vertex AI) resolves ADC and refreshes the OAuth token synchronously on the event loop on every connect

Finding: In an external report, google-genai 2.24.0 (google-auth 2.58.0, Python 3.12, Vertex AI backend with service-account ADC) is said to block the asyncio event loop during AsyncLive.connect(). The reporter says the Vertex branch calls google.auth.default() and creds.refresh() synchronously before opening the websocket, per https://github.com/googleapis/python-genai/issues/3056. When the client is built without credentials=, resolved credentials are reportedly not stored on the API client, so each connect re-resolves ADC and refreshes a token-less credentials object. Reported measurements: the max event-loop stall per connect was 517, 410 and 415 ms across three connects, with one service_account refresh per connect (same issue). The reporter contrasts this with the async REST path, which reportedly loads auth via asyncio.to_thread under an async lock, caches it, and refreshes only when needed. A non-maintainer commenter says they traced current main and found the Live path still calls the sync functions directly while _async_access_token() already provides off-loop loading, caching and a lock (https://github.com/googleapis/python-genai/issues/3056#issuecomment-6006737118). That is an independent code reading, not a maintainer-confirmed cause. A later reply said the team would file a bug internally (https://github.com/googleapis/python-genai/issues/3056#issuecomment-6015052682); it states no fix or release. Reporter's workaround: create one genai.Client(credentials=creds) per process and refresh creds off-loop with asyncio.to_thread whenever token_state is not FRESH, so connect() never takes the sync refresh branch. The reporter says max stall dropped to 9-28 ms. Proposed (unmerged) fix: use await self._api_client._async_access_token() in AsyncLive.connect(), or at minimum cache credentials and wrap the calls in asyncio.to_thread. The commenter suggests preserving explicit credentials, API-key, custom base URL and Authorization header precedence. Limitations: this is a single-setup external report; no KFA reproduction was performed, no fix commit or release is linked, and comment coverage is partial.