[AIGTWY-4877] Add MPS and MCP two-agent CUJ

[masonc08]

What did you change, and why?

Added the dedicated CUJ2 journey for a real published CodingAgentConfig: Codex uses ug_e2e.providers.openai with gpt-5-nano, Claude uses ug_e2e.providers.anthropic with claude-haiku-4-5-20251001, and both invoke system.ai.sandbox through the real agent TUIs. The runner and managed CI lane now execute the serialized workspace-backed CUJ with service-principal auth, preserve/restore any prior config, redact credentials, and install the pinned SDK through the authenticated internal Python proxy.

Skill coverage is intentionally deferred because the workspace Skill backend currently has a storage-path failure. This CUJ contains no Skill configuration, download, invocation, or assertion path.

How do you know it works?

• 60 focused runner/contract tests pass.
• Dedicated CUJ collection, Ruff/format, type checks, runner help, and diff checks pass.
• Live read-only workspace checks confirm both exact MPS targets plus system.ai.sandbox and the negative system.ai.web_search fixture.
• Full unit run: 3,170 passed and 6 skipped; four unrelated installed-agent tests fail because this developer host has machine-wide Claude/Codex policy and newer agent binaries.
• The full service-principal two-agent run is wired into the managed CI lane and will run on this PR using repository secrets.

---

This PR was created with GitHub MCP.

[github-actions]

UG review

The PR changes Codex MCP credential forwarding and workspace discovery URL construction, and adds two-agent workspace CUJs with teardown cleanup.

Major

• Exercise Codex MCP auth forwarding — src/ucode/agents/codex.py:637: can we add a local Codex stdio MCP test verifying these variables reach the proxy? TOML snapshots and name-only listings still pass when auth forwarding fails.

Automated advisory review of f18753296923 using Lilly's UG review rubric. It does not approve or block this PR.

[david-siqi-liu]

Approving. One P1 to follow up on, not blocking:

P1

• The MPS listing, MPS get, and Anthropic models calls now build URLs from normalize_workspace_url(workspace), which only adds a scheme and strips a trailing /. ug configure --workspace stores the URL as typed, so a workspace pasted as https://<host>/?o=123 turns the listing URL into https://<host>/?o=123/api/2.1/.... Before this change, https://{hostname} dropped the query. #1004 adds workspace_origin (scheme plus netloc, keeps the recorder port), and #987 carries the same hunks verbatim. Using it here avoids three PRs editing these lines three different ways.

[david-siqi-liu]

Follow-up after checking the test against the CUJ 2 plan in the UG Configure E2E doc. My approval stands, but I think these are must-fix before this counts as CUJ 2 coverage:

P0 (coverage)

• MCP is only checked by name in mcp list (system.ai.sandbox present, web_search absent), and the agent prompt says "Do not use tools". The plan's MCP checks aren't exercised: the fixture MCP authenticating, initializing and listing its tool in each agent, the tool executing with its returned value in the final answer, and transcript or service evidence of the actual tool call. The plan's fixture is ug_e2e.tools.fixture_reader; AIGTWY-4878 [3/3] Test MCP registration and tool use in Claude and Codex #990 has a tool-call pattern (per-run nonce plus sha256 receipts checked in the native transcript) that could be reused here.

P1

• Provider discovery is checked through the SDK MPS get/list, not through ug's or the agents' discovery output.

Skills are deferred per the PR body; that's the same Files API blocker CUJ 3 and CUJ 6 hit, so I'm treating it as a shared follow-up rather than blocking this PR.

[masonc08]

Follow-up after checking the test against the CUJ 2 plan in the UG Configure E2E doc. My approval stands, but I think these are must-fix before this counts as CUJ 2 coverage:

P0 (coverage)

• MCP is only checked by name in mcp list (system.ai.sandbox present, web_search absent), and the agent prompt says "Do not use tools". The plan's MCP checks aren't exercised: the fixture MCP authenticating, initializing and listing its tool in each agent, the tool executing with its returned value in the final answer, and transcript or service evidence of the actual tool call. The plan's fixture is ug_e2e.tools.fixture_reader; AIGTWY-4878 [3/3] Test MCP registration and tool use in Claude and Codex #990 has a tool-call pattern (per-run nonce plus sha256 receipts checked in the native transcript) that could be reused here.

P1

• Provider discovery is checked through the SDK MPS get/list, not through ug's or the agents' discovery output.

Skills are deferred per the PR body; that's the same Files API blocker CUJ 3 and CUJ 6 hit, so I'm treating it as a shared follow-up rather than blocking this PR.

Thanks for the review @david-siqi-liu I think initially we skipped running MCPs and skills because there was some issue with the workspace setup. I'm going to merge this PR and see what we can fix here as a followup.