fix(studio): make managed Sidecar prerequisites zero-config

[zyn080302]

Summary

• make managed Harness Sidecar prerequisites zero-configuration by using the pinned public Sidecar base image and removing registry-region gating
• bootstrap AgentKit CLI 0.52.10 from immutable public TOS archives for Linux x64/arm64, macOS x64/arm64, and Windows x64, while preserving explicit operator overrides and compatible existing installations
• resolve in this order: explicit override, compatible installed CLI, matching PATH entry, verified cache, then bounded fixed-host download
• ship the checksum-pinned Linux x64 archive with prepared Studio/FaaS bundles, but keep native archives and the retired companion-wheel dependency out of community wheels and sdists
• secure download and installation with HTTPS host and redirect validation, size and timeout bounds, retries, SHA256 verification, cross-process locking, safe tar/zip extraction, atomic cache promotion, exact version checks, and corrupt-cache replacement
• preserve effective Sidecar settings and MCP configuration across Studio deployment and update flows, retain bounded VeFaaS upload handling, and keep compression opt-in for the operations profile

Validation

• affected Python regression suite: 239 passed
• frontend regression suite: 920 passed
• packaged WebUI verification: 85 files and 229 internal references
• Ruff check and format: passed
• Pyright on changed production modules: 0 errors and 0 warnings
• clean wheel and sdist build: no AgentKit CLI companion dependency and no embedded native archive
• clean Python 3.12 wheel installation with --no-deps: agentkit_cli module import passed
• real public Linux x64 0.52.10 archive download and pinned SHA256 verification passed
• workflow YAML parse and git diff checks passed
• GitHub CI passed: Python 3.10 and 3.12 full tests, Studio release verification, pre-commit, gitleaks, license, and both Sidecar gates

Delivery boundary

• community installation does not depend on volcengine-agentkit-cli-bin
• local capability probing is non-mutating and does not download the CLI
• the CLI is bootstrapped only when a managed Sidecar deployment or release actually needs it
• this PR remains a draft; no reviewer, auto-merge, package publication, FaaS deployment, Runtime deployment, or CR operation is part of this update