Fix managed Copilot runtime discovery and startup validation - #3215

## What changes

Copilot already has a `run_macro` MCP tool, but its adapter rejects
every call in bypass mode. This adds a default-off opt-in for explicit
macro discovery and checked execution while ordinary prompts stay with
Copilot.

Set `TYPEAGENT_BYPASS_MACRO_TOOLS=true` before starting Copilot, or save
`"bypassMacroTools": true` alongside `"mode": "bypass"` in the plugin
config. The environment overrides the file setting. Invalid values are
rejected rather than enabling access.

The opt-in allows `list_macros`, `search_macros`, `inspect_macro`,
`get_macro_requirements`, `run_macro`, and `get_macro_run`. Validation,
approval, disablement, and deletion remain blocked in bypass.

Both status surfaces distinguish macro availability from prompt routing.
The README documents setup and the limits.

## What stays unchanged

Execution uses the existing local owner and macro manager, including
current approved-version checks, backend authorization, native
session/workspace binding, cancellation, and durable run results. A
disabled owner stays disabled.

This does not enable automatic recipe matching, TypeAgent delegation,
workspace tools, learning, or additional tool permissions. Unsupported
tools and backend failures do not fall back to a planner or another
provider. Capturing a trace still does not make it an executable macro.

Calls aborted before or during owner connection now stop before
dispatch; cancellation of an active run still forwards its preallocated
run ID.

This branch starts directly from main and is independent of the capture
fix (microsoft#3214) and runtime discovery fix (microsoft#3215).

## Validation

- Dependency-aware build and final plugin build passed.
- Full plugin suite: 565 Jest tests, 3 extension-layout tests, and 12
launcher tests passed.
- Nine new integration cases passed again after the final
input-discovery/latest-version assertions.
- Pinned Prettier check passed.
- All four PR gates passed against origin/main on the committed change:
lint, complexity, circular dependencies, and debt.
- Direct adversarial review covered default-off behavior, malformed
settings, all ten tool admissions, unchanged prompt routing, owner-off
behavior, backend rejection, and cancellation.

The follow-up adversarial review did not confirm a new blocking product
defect. It closed a verification gap: the original happy-path tests
mocked execution, while the real-owner test only rejected a missing
macro.

The new integration suite launches the actual bundled macro MCP server
over stdio, connects to the real local owner/broker, executes an
approved compiled program with the real RecipeExecutor/native host, and
reads the durable result. Both environment and saved-config opt-ins
succeed. Default-off/false/invalid flags, lifecycle operations, draft
and disabled/stale versions, invalid inputs, and an inactive owner fail
without native dispatch. A backend permission denial remains denied with
exactly one call and no fallback.

Only the native SDK/tool provider is a controlled read-tool fixture;
this is not live native Copilot/backend end-to-end execution of a user's
saved macro. The synthetic catalog is isolated, and no real learning
preference or permission setting is changed. This PR does not claim
additional tool replay support.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0040b8ff-2701-4fb7-821f-760e05fe6b4b