fix(studio): preserve reused MCP credentials across debug and deploy - #1088

Summary

• carry explicit MCP credential reuse decisions through Studio debug requests
• recover server-held credentials for ordinary Agents from both authTokenEnv and legacy MCP_SERVERS_JSON state
• fail closed with actionable HTTP 409 before discovery or process creation when a required stored credential cannot be recovered
• preserve exact custom MCP endpoint paths without requiring or appending /mcp
• classify authentication, endpoint, rate-limit, upstream, timeout, network/TLS, protocol, and empty-tool failures without exposing credentials or upstream bodies
• state explicitly that MCP discovery failures happen before debug startup and are unrelated to Sidecar
• preserve fail-closed isolation across Agent, slot, and reference boundaries
• map invalid historical MCP URL recovery to an actionable HTTP 409 instead of HTTP 500
• include the MCP bad-case suite in the Harness/six-case release gate

Root cause

The deploy path transported explicit reuse decisions, but the ordinary-Agent debug path did not always restore the corresponding server-held credential. Debug could then attempt anonymous discovery and collapse unrelated failures into one HTTP 422. Separately, the UI treated every non-/mcp path as suspicious even though MCP endpoints can use arbitrary business paths, and invalid legacy URLs could escape the existing HTTP mapping as HTTP 500.

Verification

• 265 affected backend tests passed locally
• 1052 frontend tests passed locally
• real local Streamable HTTP integration passed with a custom /athena-mcp path, Bearer authentication, initialize/session negotiation, and tools/list
• frontend production WebUI and widget builds passed
• Ruff, pre-commit, gitleaks, and diff checks passed
• exact PR head passed Python 3.10 and 3.12, License-Check, Codex smoke, Harness/six-case/MCP release gate, production Studio Bundle build, and customer-update smoke

No Release Server, Studio Release, production TOS, customer FaaS, or existing Agent mutation is included in this PR.