[codex] publish Qdrant Agent Contract v2 manifest

[MADPANDA3D]

Agent-first provider hardening

This draft reconciles the provider's deployed Agent Contract v2 work through
the normal repository review path.

User/agent problem

Provider discovery previously depended on inconsistent or incomplete metadata,
and fleet authorization, health, build provenance, and navigation behavior did
not share one enforceable contract. That made tool selection and production
truth harder for agents to trust.

Root cause

The provider did not own a complete versioned ToolManifest and the shared fleet
conformance gate did not exist in its repository. Runtime health and local
navigation behavior had also evolved independently across services.

Change

• Publishes the provider-owned, lossless tool manifest with input/output schema,
  aliases, annotations, risk, contract tier, and build/catalog provenance.
• Exposes the standard grant-only navigation surface:
  check_configuration, list_capabilities, get_endpoint_coverage,
  get_tool_usage, and find_tools.
• Normalizes health/build/catalog fields while preserving compatibility fields.
• Rejects missing or invalid Portal grants before provider parsing/work.
• Adds the caller for the central reusable MCP conformance workflow.

Verification

• Local provider tests, manifest contract checks, Compose validation, and
  tracked-secret scan passed before publication.
• Live fleet conformance passed 13/13 providers.
• Live golden prompts passed 52/52; positives ranked first and negative cases
  returned no result.
• The deployed service reports a traceable build SHA and catalog version.

Merge ordering

This PR is intentionally a draft. The central reusable workflow in
MADPANDA3D/MADPANDA-MAIN-SITE must merge before this caller can resolve
@main. Hosted workflow evidence should be reviewed after that dependency is
available.

No force-push was used and unrelated worktree files were not staged.

Refs: MAD-636, MAD-625, MAD-639

[MADPANDA3D]

Hosted CI follow-up: commit 02b85ad restores the declared Python 3.10 compatibility and pins each uv matrix job to its requested interpreter. Local Python 3.10 and 3.12 suites pass 98/98; pre-commit passes. Hosted Run Tests now passes across 3.10, 3.11, 3.12, and 3.13; hosted pre-commit and Docker CI also pass. The only remaining failed check is the expected shared-conformance caller dependency, which cannot resolve until MADPANDA-MAIN-SITE PR #3 is reviewed and merged. Refs: MAD-639.