Enable deployment MCP defaults on generic workers

[Andrew Chung (andrewkcchung)]

Summary

• load deployment-owned DEFAULT_MCP_JSON on the standard generic worker when no startup module supplies MCP worker options
• create URL-bound workload-identity headers from MCP_WORKLOAD_IDENTITY_SCOPES
• preserve startup-module precedence so composition-owned workers do not double-load MCP configuration
• project both optional settings through the Azure generic worker's existing worker-env ConfigMap
• document repo-less generic-worker behavior

Validation

• SDK build and type-check
• focused generic-worker, startup-module, worker-entrypoint, and manifest-staging unit tests
• repository privacy check
• locally built and pushed the worker through an external composition repository
• rolled the generic worker on staging and production with no repository startup module
• confirmed a repo-less session completed tools from both an HTTPS deployment MCP and an exact cluster-local HTTP deployment MCP using workload identity

Behavior

Deployment MCP configuration remains optional. Invalid catalog or scope mappings fail closed, while a configured startup module remains authoritative. The Azure deployment accepts the values from its normal environment overlay and publishes them through the hashed worker-env ConfigMap.