Add provider-native web and MCP tool execution

[yanpgwang]

What changed

• Send Web Search and Web Fetch as provider-native Messages API tools while preserving opaque provider blocks for lossless continuation.
• Add a private provider transcript and public/provider tool ID mappings, committed atomically with public turn completion.
• Add MCP Streamable HTTP discovery and invocation using the official Go SDK, with per-Session discovery snapshots, permission policies, and stable tool aliases.
• Materialize oversized and binary tool results in the Session sandbox while keeping bounded model and workflow projections.
• Keep model and connector credentials deployment-managed. Agent and Session resources do not accept user-owned credentials; the current MCP connector supports unauthenticated endpoints.
• Document the storage, context, Temporal, sandbox, and credential boundaries.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• npm --prefix website run typecheck
• npm --prefix website run build
• git diff --check
• Same persistent Claude review session re-verified the blocker fixes and returned a Ship verdict.

PostgreSQL-backed integration tests were not enabled locally because MANAGED_AGENT_TEST_DATABASE_URL is not configured.

Compatibility

The native tool declarations and connector design follow the official Anthropic Web Search, Web Fetch, Managed Agent tool, permission, and MCP connector contracts:

• https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool
• https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool
• https://platform.claude.com/docs/en/managed-agents/tools
• https://platform.claude.com/docs/en/managed-agents/permission-policies
• https://platform.claude.com/docs/en/managed-agents/mcp-connector

Durability and security

• Adds migrations 00007_provider_transcript.sql and 00008_mcp_discovery_snapshots.sql.
• Provider transcript deltas, public events, tool mappings, and processed triggers commit in one PostgreSQL transaction.
• MCP calls use the existing operation journal and become ambiguous instead of being blindly retried after a possible side effect.
• The default MCP transport rejects private, loopback, link-local, metadata, CGNAT, reserved, and rebinding targets at dial time.
• Raw MCP metadata and oversized results do not enter model context or unbounded Temporal payloads.
• Credentials remain in deployment or worker environment configuration and are not stored in Agent, Session, PostgreSQL, Temporal, sandbox, or logs.

Checklist

• Tests cover the changed behavior.
• Public behavior is documented.
• Compatibility claims cite official sources.
• No credentials, generated build output, or local databases are included.