Support environment-origin MCP plugins across native runtimes

[SaladDay]

Environment Templates could install Plugin Skills but could not execute Environment-origin MCP declarations. This change enables MCP-only and combined Skill/MCP packages through the shared frozen installation flow and native Codex, Claude Code and MiniMax Code adapters, including exact capability-directory roots.

Stdio uses the existing isolated Runtime and native transport. A stable launcher keeps servers alive when native creator threads exit and stops their sandbox descendants when the owning process exits. HTTP support follows qualified native boundaries: Codex literal headers/HTTPS bearer and Claude anonymous/HTTPS bearer without custom headers; unsupported combinations fail explicitly. Core remains harness/Provider neutral. The existing Codex tool environment hook also handles native /bin/sh correctly.

Validation:

• Full standalone make check, OpenAPI generation, focused Go/race and Claude SDK checks passed on zju_a100_2.
• Fixed OpenAI SDK 3.13.0 and raw HTTP against independent Core/PostgreSQL/Docker passed real Kimi/MiniMax execution on all three harnesses: Plugin/Skill discovery, credentials and tenant isolation, Files/Artifacts, deleted-template/source cold recovery, cancellation and saved/live event consistency.
• Separate real Codex/Claude HTTPS workflows passed; Linux/native lifetime and startup-race checks and 30 actual sh/Bash hook cases passed.

Coverage, exact runs and limits are recorded in contracts/agents-api/environment-templates.md. This does not claim new E2B Plugin MCP qualification or complete protocol compatibility.

Independent GPT-6 Astra high whole-diff review found no blockers; the existing reviewer context was reused with explicit user authorization.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}