Add managed MCP support across SDKs

[mattdholloway]

Summary

• Add the additive managedMcpServers session create/resume contract across Node.js, Python, Go, .NET, Rust, and Java.
• Regenerate supported RPC and session-event bindings for managed provenance, display metadata, optional ttlMs, and the explicit broker-error result.
• Add high-level dynamic-header refresh handlers in every SDK while preserving raw RPC access.
• Dispatch headers, no-result, broker failures, cancellation, and handler panics/failures through the runtime response contract.
• Document managed origin versus HTTP transport and the host responsibilities for trusted catalogs, memory-only credentials, expiry/revocation, and cold resume.

Compatibility

This is additive. Existing mcpServers, MCP OAuth handlers and storage, local stdio, SSE, arbitrary HTTP servers, static headers, and low-level RPC APIs remain unchanged. Managed catalog entries use a separate field so the runtime establishes source: "managed" provenance without changing transport semantics.

The branch is merged with the current main base and preserves upstream ask-user variants, runtime artifact resolution, and the generated contract changes introduced since the PR was opened.

Validation

• Node.js: Prettier, ESLint, typecheck, build, and 5 focused managed-MCP tests pass.
• Python: Ruff formatting/lint, ty, and focused managed-MCP tests pass.
• Go: gofmt, golangci-lint, and focused managed-MCP tests pass.
• .NET: restore, formatting verification, build, and 5 focused managed-MCP tests pass.
• Rust: nightly rustfmt, Clippy, managed-MCP serialization/dispatch tests, and the failed-interest cleanup regression test pass with runtime download disabled for the local compile-only validation.
• Java: Spotless, Checkstyle, compilation, and 111 focused tests pass with the JDK 25 enforcer skipped because this machine has JDK 17.
• Generated outputs reproduce byte-for-byte from the current @github/copilot@1.0.83-0 schemas plus the focused agent-runtime managed-MCP schema delta.

Dependency and rollout

Depends on github/copilot-agent-runtime#17210 (35f85a07ce50b547cb282036cae87096c92c3caf). The currently pinned @github/copilot@1.0.83-0 package still does not contain this contract, so the repository's default package-based codegen freshness check remains externally blocked until a CLI package containing the runtime change is published. This PR does not bypass that limitation: its generated files use the canonical runtime schemas with only the managed-MCP nodes overlaid on the currently pinned package schema.

Catalog implementation, token-broker implementation, and CLI rollout are intentionally out of scope.

Closes github/copilot-mcp-core#2140