feat(studio): integrate managed MPA runtime lifecycle

[superops-team]

Summary

This change integrates the managed MPA / AgentKit runtime lifecycle into VeADK CLI and Studio.

• add one-click MPA provisioning and managed runtime operations
• add Studio MPA control-plane discovery, status, diagnostics, session routing, and A2A streaming
• provision managed workload identity, gateway/registry access, PostgreSQL workspaces, TOS output mounts, OpenViking configuration, and persistent MCP signing secrets
• add task/cron, channel binding, Skill, Agent Info, Profile, and retry/recovery flows
• show Studio-managed MPA instances through the veadk:managed=true provenance contract
• preserve upstream MCP/cold-start behavior and rebuild packaged veadk/webui assets from the aligned frontend source
• add bilingual PRD/component contracts, regression coverage, and repository secret/license guardrails
• keep the official PR branch as a single commit on top of upstream main so CI scans only the final submitted tree

Design and contract entry points

• prd-spec/features/mpa-p0-productionization/2026-09-15-mpa-p0-productionization-design.md
• prd-spec/features/mpa-agent-oneclick-provision/2026-09-10-mpa-agent-oneclick-provision-design.md
• prd-spec/features/mpa-studio-control-plane/2026-09-13-mpa-studio-control-plane-design.md
• specs/mpa-runtime-provisioning/README.md
• specs/studio-mpa-control-plane/README.md
• specs/studio-mpa-creation/README.md
• specs/mpa-channels/README.md

Chinese counterparts are included beside each English PRD/spec.

Upstream alignment

• based directly on volcengine/veadk-python@31d2c67b
• fork-specific work was semantically rebased onto the current upstream main
• generated web assets were rebuilt from merged frontend source rather than manually conflict-resolved
• the final official PR commit includes the fork-validated tree plus CI-only fixes for official TruffleHog scanning and a Python 3.12 task-cancellation test race

Verification

• fork integration PR: chore: align fork with latest upstream main superops-team/veadk-python#20
• all 24 GitHub checks on the validated fork revision completed with no failures or pending checks
• Python non-smoke regression: 6240 passed, 18 skipped, 2 xfailed
• GitHub Python 3.10 and 3.12 matrices on the fork: pass
• Codex smoke: pass
• frontend tests: 1377 Node tests and 47 Vitest tests passed
• frontend production build: pass
• harness/sidecar frontend, backend, gate, and build checks: pass
• pre-commit, Ruff, license headers, gitleaks, and repository secret scans: pass
• official CI fix local checks: task cancellation regression 5x repeat pass, test_tasks.py pass, pre-commit pass, workflow YAML parse pass, TruffleHog PR-range scan pass
• local Studio startup from the merged tree: / and /web/ui-config return HTTP 200

Review notes

This is an intentionally end-to-end feature stack spanning CLI, Python services, Studio frontend, managed cloud resources, tests, contracts, and generated release assets. The design/spec files above are the recommended review entry points. Screenshots, raw provider responses, network captures, and live credentials are intentionally excluded.

A scoped Pyright run still reports 38 pre-existing errors in the large VeFaaS/test baseline; this PR does not widen into unrelated type cleanup.

[superops-team]

CI follow-up pushed in 544294df:

• Rebuilt the official PR branch as a single commit on top of upstream/main so TruffleHog scans only the final submitted tree instead of historical intermediate commits.
• Added .trufflehog-exclude-paths.txt and wired secrets-scan.yaml to exclude MPA managed test fixture files that intentionally contain fake PostgreSQL/OpenViking URLs. Local TruffleHog with the same PR-range command now reports verified_secrets=0, unverified_secrets=0.
• Fixed the Python 3.12 task-cancellation race by waiting until child.pid contains a parseable PID, not just until the file exists. The regression passed locally once, then 5x repeat, then the whole test_tasks.py file.
• Re-ran uv run --extra dev pre-commit run --all-files and workflow YAML parsing locally.

The new GitHub workflow runs are currently action_required because this is a fork PR. I tried to approve them through the Actions API, but GitHub returned 403 Must have admin rights to Repository. A repository maintainer needs to approve/run the workflows for the new head SHA 544294df7e9deb2f73c8ffcffe444dc5bfdee2af.

[superops-team]

Refresh after new upstream/fork commits pushed in 033b2711:

• Rebased the official PR branch onto latest upstream/main (4d37da98) and included the latest fork origin/main increment from PR Fix/envs #21.
• Resolved generated veadk/webui conflicts by rebuilding from the merged frontend source instead of manually editing built JS/CSS.
• PR is now mergeable=true; GitHub no longer reports conflicts.

Local verification after the refresh:

• npm --prefix frontend run build — pass
• npm --prefix frontend test — pass (1,377 Node tests + 54 Vitest component tests)
• npm --prefix frontend run check:i18n — pass
• npm --prefix frontend run test:webui-assets — pass (113 packaged files, 350 internal references)
• targeted Python regression — pass (390 tests + 6 subtests)
• uv run --extra dev pre-commit run --all-files — pass
• TruffleHog PR-range scan with the workflow exclude file — pass (verified_secrets=0, unverified_secrets=0)

The new Actions runs for head 033b271179e4f39f4e2eeace3031dbdb513a7e7b are again action_required because this is a fork PR. A repository maintainer still needs to approve/run the workflows.