fix(studio): harden Agent updates and SkillSpace fallback

[zyn080302]

Summary

• add a bounded pre-output TPM/RPM retry that snapshots the pristine ADK request and never duplicates streamed output
• keep MCP credentials server-side during Runtime updates and reject duplicate canonical MCP names or endpoints with precise errors
• recover readable SkillSpace entries when a dangling relation returns ResourceNotFound.skill, using degraded name-based identity and warnings
• start the pinned AgentKit companion and Studio concurrently while preserving fail-closed startup semantics
• make the staged native CLI archive world-readable for the VeFaaS runtime user

Verification

• full Python suite: 3689 passed, 9 skipped, 2 expected failures
• focused Python regression suite: 280 passed
• frontend suite: 1030 passed
• pre-commit: Ruff, formatting, and secret detection passed
• offline Studio Bundle: 260.261 seconds; 191 files / 186 hash-locked wheels; Linux Python 3.12 dry-run passed
• fresh Linux/amd64 non-root cold start: companion and Studio ready in 51 seconds with no permission or startup errors
• protected VeFaaS acceptance: real offline dependency install and Release succeeded; stable/latest, 100% traffic, Ready, Identity, sibling Function, and Scheduler companions verified

No Studio or Release Server publication was performed.