configurable agent session runtime

[vmelikyan]

• Move AI SDK agent-session runtime controls into admin-managed config
• Add support for maxIterations, workspace tool discovery/execution timeouts, and runtime workspace settings
• Expose runtime and effective config through the core API and OpenAPI
• Persist the session same-node attachment policy so later service attachments stay consistent
• Apply the discovery timeout to MCP tool listing and honor execution timeout on sandbox tools
• Add validation, defaults, migration updates, and focused unit coverage

[vigneshrajsb]

Reviewed the runtime configurability changes and API/runtime plumbing end-to-end. Looks good to merge.