ci: stabilize live harness shards and MCP App E2E policy

[jmagar]

Problem

The hosted integration split exposed two different failures that were being conflated:

1. copies of the shared live_labby process harness were running concurrently across many integration binaries, exhausting unchanged readiness/cleanup budgets under hosted load; and
2. Live E2E's MCP App qualification still assumed the manager resource started disabled, while fresh Labby installs now intentionally default the manager UI on.

A policy-only change to .config/nextest.toml also was not guaranteed to route through the full Rust test path.

Change

• serialize every embedded live_labby::* support case across platforms
• serialize integration binaries that own real daemon/browser/process state without inflating product deadlines
• de-duplicate embedded harness tests from labby-int-* shards and run them once through live_process_harness
• route .config/nextest.toml changes through the full Rust test path and pin the policy in regression tests
• bound Agent runtime duration to the authority-lease contract instead of the old 24-hour ceiling
• keep action_matrix_completeness from importing unrelated live-process support
• align MCP App qualification with the default-on manager policy: disable via the real mcp_app control tool, then prove direct resource reads cannot bypass the disabled policy
• make the browser qualification wait on the actual manager switch state rather than brittle status text
• restore scripts/ci/changed_paths.py executable mode

Local verification

• cargo fmt --all -- --check: pass
• git diff --check: pass
• workspace all-features/all-targets Clippy with -D warnings: pass
• runtime authority-lease bound regression: pass
• nextest/changed-path policy regressions: 2/2 pass
• action matrix: 15/15 pass
• MCP App qualification: 1/1 pass
• all five labby-int-* shards pass serially with the de-dup policy
• docs: 17 generated artifacts fresh, 603 local links, 116 canonical docs, 5/5 contract tests
• full Live E2E produced green receipts for contracts, HTTP/CLI/API, observability, IPv6, MCP parity, and identity/protected/restart; the final MCP App host shard passes locally with Macpoo's Playwright cache. GitHub Actions uses the script's native /home/runner/.cache/ms-playwright path.

Fresh CI on this head is the authoritative hosted-runner proof. Merge only after every hosted lane, including Live E2E core, is green.