fix(supervisor): accept mixed-case MCP version protocols

Validate materialized MCP version metadata through the parsed L7 protocol so supported mixed-case spellings remain valid. Cover YAML and protobuf ingress with pinned-default regression tests.

Signed-off-by: Shiju <shiju@nvidia.com>

Author: shiju-nv

crates/openshell-supervisor-network/src/l7/mod.rs

@@ -1285,7 +1285,7 @@ pub fn validate_l7_policies(data_json: &serde_json::Value) -> (Vec<String>, Vec<
                     "{loc}: JSON-RPC-specific endpoint fields are ignored unless protocol is json-rpc or mcp"
                 ));
             }
-            validate_mcp_versions_field(&mut errors, &loc, ep, protocol);
+            validate_mcp_versions_field(&mut errors, &loc, ep, l7_protocol);
             let has_mcp_strict_tool_names = ep.get("mcp_strict_tool_names").is_some();
             let has_mcp_allow_all_known_mcp_methods =
                 ep.get("mcp_allow_all_known_mcp_methods").is_some();
@@ -1609,12 +1609,12 @@ fn validate_mcp_versions_field(
     errors: &mut Vec<String>,
     loc: &str,
     endpoint: &serde_json::Value,
-    protocol: &str,
+    protocol: Option<L7Protocol>,
 ) {
     let Some(value) = endpoint.get("mcp_versions") else {
         return;
     };
-    if protocol != "mcp" {
+    if protocol != Some(L7Protocol::Mcp) {
         errors.push(format!(
             "{loc}: mcp.versions is only valid for protocol mcp"
         ));

crates/openshell-supervisor-network/src/opa.rs

@@ -4930,15 +4930,15 @@ network_policies:
     }
 
     #[test]
-    fn l7_endpoint_config_materializes_default_mcp_versions_without_alias() {
+    fn yaml_load_accepts_mixed_case_mcp_protocol_with_default_versions() {
         let data = r#"
 network_policies:
   mcp:
     name: mcp
     endpoints:
       - host: mcp.example.com
         port: 443
-        protocol: mcp
+        protocol: MCP
         rules:
           - allow:
               method: tools/list
@@ -5485,11 +5485,17 @@ network_policies:
     }
 
     #[test]
-    fn proto_load_accepts_defaultable_mcp_versions() {
-        for policy in [
-            defaultable_mcp_proto(None),
-            defaultable_mcp_proto(Some(McpOptions::default())),
-        ] {
+    fn proto_load_accepts_defaultable_mcp_versions_with_mixed_case_protocol() {
+        let mut implicit_defaults = defaultable_mcp_proto(None);
+        implicit_defaults
+            .network_policies
+            .get_mut("mcp")
+            .expect("defaultable MCP fixture contains the MCP policy")
+            .endpoints[0]
+            .protocol = "Mcp".to_string();
+        let explicit_defaults = defaultable_mcp_proto(Some(McpOptions::default()));
+
+        for policy in [implicit_defaults, explicit_defaults] {
             let engine = OpaEngine::from_proto(&policy)
                 .expect("supervisor ingress must materialize the pinned MCP revision");
             let input = NetworkInput {