mcp: proactively re-mint managed proxy tokens before expiry during agent runs

[Legoben]

Problem

The previous PR heals an expired token reactively (first failed call pays a reconnect round-trip). For long agent runs we can do better: the mutation's expires_at tells us exactly when the token dies, and re-minting early is cheap and overlap-safe.

Changes

• Resolution now also records expires_at per managed installation (previously a dead field on the mutation output).
• New managed_mcp_refresh::refresh_loop, raced as a third select! arm in with_credential_refreshes (same pattern as the git/Bedrock credential loops — never resolves, dropped when the run finishes): sleeps until 5 minutes before the earliest expiry (never spinning faster than 60s), re-mints due entries with the full startup retry budget, and respawns via the new TemplatableMCPServerManager::respawn_with_installation — which skips the refresher (config is pre-refreshed) and defers to any reactive reconnect already in flight.
• Stop conditions: runtime-kind tokens are anchored to the task's start, so a re-mint that doesn't extend the deadline drops the entry (the sandbox ends then anyway); re-mint failures also drop the entry and leave recovery to the reactive path. Respawn happens only when the rendered config actually changed.

Known trade-off (accepted): a proactive respawn tears down the live transport; a tool call in flight at that instant gets TransportClosed and is retried once against the fresh connection by ReconnectingPeer.

Flag-gated by McpSelfHeal (the loop is only armed when managed entries with expirations exist).

Tests

Schedule math (wake at expiry−lead, 60s clamp for due/past tokens, due-window boundaries) plus a resolution test asserting expires_at is captured into the schedule.

[Legoben]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• mcp: detect dead transports, add Reconnecting state, background reconnect #15540
• mcp: proactively re-mint managed proxy tokens before expiry during agent runs #15539 👈 (View in Graphite)
• mcp: re-mint expired managed proxy tokens on demand instead of failing or misrouting to OAuth #15538
• mcp: broaden reconnect retry, add per-server backoff, keep tools visible during reconnect #15537
• mcp: classify auth failures (HTTP + SSE) and guard OAuth credential deletion #15536
• mcp: retain spawn configs so reconnect works for ephemeral/managed/builtin servers #15535
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.