[Integration DoD][MW-07] Add MCP config-to-runtime attach e2e validation

[github-actions]

This issue is auto-generated from INTEGRATION_DOD_MAP.md by the nightly DoD gap sync workflow.

Gap

• ID: MW-07
• Owner (area-owner): API

Acceptance Criteria

• E2E validates MCP config write path, reject-path guards, and runtime status behavior.

Verification Commands

bunx vitest run --config vitest.e2e.config.ts test/mcp-config.e2e.test.ts

Risk

• Broken or unsafe MCP execution paths.

Source

• INTEGRATION_DOD_MAP.md:463

[hellopleasures]

Fix submitted in PR #768.

10 new unit tests (34→44): cwd validation (non-string, valid), timeoutInMillis validation (negative, NaN, non-number, valid), http/sse config type acceptance, http SSRF rejection, sse without URL rejection.

4 new e2e tests (37→41): $include as server name rejection (prototype pollution), cloud metadata SSRF (metadata.google.internal), http/sse config type validation.