fix(studio): harden managed Sidecar MCP routing and build status

[zyn080302]

Summary

• preserve existing Runtime update configuration for arbitrary HTTP MCP paths, token environment references, and managed Harness Sidecar intent
• route managed in-container MCP traffic through a proxy-free loopback relay that normalizes MCP session headers and avoids public Runtime Gateway hairpin failures
• support MCP-only Sidecar plans with Model Proxy disabled while retaining fail-closed Runtime wrapper, dependency, and source-snapshot checks
• keep ordinary non-Sidecar Agents and ordinary MCP clients unchanged
• retain the existing explicit handling for unconfirmed Code Pipeline build results

Verification

• VeADK full suite: 2,646 passed, 6 skipped, 6 subtests passed
• repository pre-commit: Ruff check, Ruff format, and Gitleaks passed
• rebased onto the latest main; source diff check passed
• current managed application no-cache linux/amd64 build: 16.30 seconds
• network-isolated Runtime acceptance: Sidecar ok, /vmetrics discovered 2 tools, 1 Agent function call, 1 matching function response, and terminal text
• stored-Agent update hydration preserved the MCP path, token reference, Runtime env, and Sidecar plan

No VeFaaS, cloud Runtime, CR, Pipeline, or customer resource was updated as part of this change.