fix: restore MCP credentials for Studio debug runs

[zyn080302]

Summary

• recover unchanged published MCP credentials from the authorized Runtime before Studio creates an ephemeral debug run
• • bind recovered values to the server-trusted Agent/MCP name/URL/reference identity so changed endpoints cannot inherit old credentials
• • keep Runtime-held secrets server-side and never serialize them in the debug-run response

Problem

For both older and newly deployed Agents, the formal Runtime had a working MCP Key, but Update -> validation -> start debug environment failed with HTTP 422 during Streamable HTTP tool discovery. The debug route attempted discovery before loading the Runtime-held credential.

Tests

• uv run --frozen pytest -q tests/cli/test_generated_agent_backend_codegen_extended.py tests/cli/test_legacy_runtime_recovery.py::test_unchanged_mcp_reference_resolves_from_structured_runtime_secret tests/cli/test_legacy_runtime_recovery.py::test_changed_mcp_url_requires_explicit_server_validated_reuse (58 passed)
• • uv run --frozen ruff check veadk/cli/cli_frontend.py tests/cli/test_generated_agent_backend_codegen_extended.py
• • pre-commit Ruff, format, and hardcoded-secret checks