Add model discovery integration tests with managed config

[andy-xu-db]

Summary

• Add Tests-table Cases 1–12, where managed config exists, as the first model-discovery test PR.
• Cover 12 named tests and 24 configured/fresh executions across dedicated Claude Code and Codex managed modules.
• Fetch the workspace's real CodingAgentConfig once per agent module, derive one MPS-backed test variant, and reuse that mode-0600 stub across every isolated test session.
• Verify that the admin catalog wins even when developer discovery is disabled and that conflicting provider/model-location overrides fail without changing agent state.

Managed workspace

The managed jobs use the workspace configured by the GitHub Actions secret E2E_ADMIN_WORKSPACE. The runner mints a short-lived bearer with E2E_ADMIN_SP_CLIENT_ID and E2E_ADMIN_SP_CLIENT_SECRET; it does not select a developer Databricks profile or use a PAT.

Each module calls GET /api/ai-gateway/v2/coding-agent-configs once and keeps the first config, matching production selection. The test variant changes only the selected agent's model source and removes its incompatible static defaults:

• Claude Code: main.default.ci_e2e_anthropic_mps
• Codex: main.default.ci_e2e_openai_mps

The stub is outside the uploaded artifact root and reused through UCODE_MANAGED_CONFIG_STUB. test_ug_configure_managed.py remains un-stubbed so the real fetch/cache/wire contract is still covered.

Cases

Cases	Scope	Executions
1–4	managed source after configure and with developer discovery disabled	8
5–12	conflicting provider/location overrides, configured + fresh	16

Each test function includes its Tests-table case number (test_case_01_... through test_case_12_...).

Stack

• Base: codex/model-discovery-test-stack (rebased on current main).
• Follow-up: Add model discovery integration tests without managed config #662 adds unmanaged-config Cases 13–24.

Verification

• Head: 76d42794a3061efe256f32dc3f5a6b5d7a644168.
• CI run 35284235166: both managed-config lanes and both full-journey lanes passed.
• tests/test_integration_contract.py: 4 passed.
• Managed discovery collection: 24 executions; complete integration collection: 79.
• Ruff, formatting, and diff checks passed.
• No local Databricks profile was selected.

The run's separate Claude agent-launch shard fails because system.ai.claude-opus-5 rejects Claude Code's advisor_20260301 tool type. That path is outside this PR's managed-discovery files; aggregate checks inherit the same failure.