Add managed MCP support across SDKs

[mattdholloway]

Summary

• Add the additive managedMcpServers session create/resume contract across Node.js, Python, Go, .NET, Rust, and Java.
• Regenerate supported RPC and session-event bindings for managed provenance, display metadata, optional ttlMs, and the explicit broker-error result.
• Add high-level dynamic-header refresh handlers in every SDK while preserving raw RPC access.
• Dispatch headers, no-result, broker failures, cancellation, and handler panics/failures through the runtime response contract.
• Document managed origin versus HTTP transport and the host responsibilities for trusted catalogs, memory-only credentials, expiry/revocation, and cold resume.

Compatibility

This is additive. Existing mcpServers, MCP OAuth handlers and storage, local stdio, SSE, arbitrary HTTP servers, static headers, and low-level RPC APIs remain unchanged. Managed catalog entries use a separate field so the runtime establishes source: "managed" provenance without changing transport semantics.

The branch is merged with the current main base and preserves upstream ask-user variants, runtime artifact resolution, and generated contract changes introduced since the PR was opened.

Validation

• Node.js: Prettier, ESLint, typecheck, build, focused managed-MCP tests, and schema-overlay guard tests pass.
• Python: Ruff formatting/lint, ty, and focused managed-MCP tests pass.
• Go: gofmt, golangci-lint, and focused managed-MCP tests pass.
• .NET: restore, formatting verification, build, and focused managed-MCP tests pass.
• Rust: nightly rustfmt, Clippy, managed-MCP serialization/dispatch tests, and the failed-interest cleanup regression test pass with runtime download disabled for the local compile-only validation.
• Java: Spotless, Checkstyle, compilation, and 111 focused tests pass with the JDK 25 enforcer skipped because this machine has JDK 17.
• The repository's normal shared and Java codegen commands reproduce the generated outputs.

Dependency and rollout

Depends on github/copilot-agent-runtime#17210 (35f85a07ce50b547cb282036cae87096c92c3caf). The currently pinned @github/copilot@1.0.83-0 package still does not contain this contract.

Until a CLI package containing the runtime change is published, codegen applies a repository-local, fail-closed schema overlay containing the exact pre-contract and target nodes from agent-runtime#17210. It accepts only the known pinned legacy shape or the final target shape, rejects missing or unknown upstream definitions, and is exercised by the normal codegen commands. Remove the overlay after the pinned package publishes the same schema.

Catalog implementation, token-broker implementation, and CLI rollout are intentionally out of scope.

Closes github/copilot-mcp-core#2140