feat(mpa): complete Studio details and managed account provisioning

[moidream]

Changes

Managed MPA creation could reuse resources from an old account or fail when the new account had no pre-existing worker template. Resolve the deployment account through STS, prepare Runtime IAM permissions, validate/discover account-local network resources, create a standard shared APIG, and create workers independently from the configured image. Preserve Python 3.10 timeout handling, resource naming, skill-space descriptions, image defaults, and deployment diagnostics.

Include the omitted fork PR #22 behavior: MPA details show Basic only and do not start hidden Profile/control-plane requests. General Agent navigation and update behavior stay unchanged. Rebuild the packaged Studio UI and include bilingual designs and component contracts.

Contribution coverage

• Based directly on current official main (171d8d86), which already contains PR feat(studio): integrate managed MPA runtime lifecycle #1156.
• Audited all 83 non-generated paths added/changed between the fork alignment merge ef0ad519 and fork main 035387d1.
• Fork PR Fix/envs #21's named, three-step creation is already in the official base; PR fix: fix studio import #22 is now included; PR Chore: update studio web #23's provisioning fixes remain included.
• Preserve official Codex/BytePlus changes, secret-scan exclusions, and the cancellation PID race fix.

Verification

• Managed MPA/CLI targeted Python tests: 678 passed.
• Frontend: 1,377 Node tests and 65 Vitest tests passed; the 10 Basic-only regressions failed before the port and passed afterward.
• TypeScript, production app/widget build, i18n, and packaged assets (113 files / 350 references): pass.
• Sidecar coverage: statements 98.55%, branches 94.44%, functions/lines 100%; changed Basic-only executable statement-start lines: 7/7 covered.
• Loopback browser using the actual workspace and mocked network: MPA/General navigation, hidden focus, switching, loading/error/empty environment/read-only states, chat callback, keyboard focus, and 390px viewport verified. No hidden Profile requests.
• All-files pre-commit including secret scanning: pass.
• Full Python regression with declared optional extras, two workers: 6,869 passed, 53 skipped, 4 xfailed, 1 failed. The only failure is the unchanged artifact writer MIME test on local Python 3.10/macOS (.md resolves to application/octet-stream, expected text/markdown); both test and implementation match official main. This baseline failure remains unresolved.

No real cloud resources were created or deployed during this integration. Detailed dated verification and coverage audit are in the paired mpa-upstream-incremental-alignment PRDs.