fix(studio): make managed Sidecar prerequisites zero-config

[zyn080302]

Summary

• make managed Harness Sidecar prerequisites zero-configuration with the pinned public Sidecar base image and no registry-region setup
• bootstrap AgentKit CLI 0.52.14 from immutable checksum-pinned public archives on Linux x64/arm64, macOS x64/arm64, and Windows x64
• preserve explicit CLI overrides and compatible existing installations, then fall back through PATH, verified cache, and bounded fixed-host download
• keep native CLI archives out of community wheels and sdists while including the verified Linux x64 archive in prepared Studio/FaaS bundles
• preserve structured MCP configuration across create and update, recover an unchanged MCP credential binding, and require an explicit reuse, replacement, or no-auth choice after an MCP URL change
• retain bounded VeFaaS upload, offline dependency installation, online Studio update compatibility, and opt-in compression for the operations profile

Validation

• targeted frontend MCP and deployment regressions: 69 passed
• targeted backend MCP recovery, Runtime update, and RBAC regressions: 76 passed
• complete frontend suite, TypeScript no-emit, production WebUI build, packaged-asset verification, Ruff, and pre-commit passed before the PR head update
• AgentKit CLI 0.52.14 public archives were checksum-verified for all five supported platform targets; Linux x64 version and archive layout were also verified
• GitHub checks are rerunning for the current PR head

Delivery boundary

• community installation does not depend on volcengine-agentkit-cli-bin
• local capability probing is non-mutating and does not download the CLI
• CLI bootstrap occurs only when a managed Sidecar deployment or release requires it
• this PR is ready for review; this update does not merge the PR, publish a package, deploy FaaS, or mutate any Runtime or CR