feat(studio): integrate TOS IAM roles with MPA lifecycle

[PolarisCzh]

Summary

Replaces #25 using an independent branch based on feat/mpa-lifecycle-upstream-20261013 (2ffe6e14). The shared source branch and official volcengine/veadk-python#1163 are unchanged.

• Integrate bucket-only TOS IAM Role mounting and additive, bucket-scoped authorization with the target's lifecycle changes.
• Preserve automatic OpenViking, per-agent PostgreSQL Workspace / dedicated aidb name preflight, maximum-instance selection and retry identity.
• Restrict Studio bucket choices to agentkit-platform-; remove TOS credential fields and strip stale draft credentials.
• Update the empty-selection hint: files remain in the sandbox's local directory. No mount behavior changes from this wording amendment.
• Rebuild packaged WebUI assets and maintain bilingual design/contracts. No cloud deployment or existing Tool/Session migration.

Validation

• Added 4 combined lifecycle/TOS cases; request module 18/18, dialog 67/67 pass.
• Related Python: 1,038 passed (Python 3.12.12).
• Full frontend: 1,389 Node tests and 105 Vitest cases passed.
• Executable diff coverage against target: Python 102/102, TypeScript 10/10 (100%, above requested 95%).
• Build, packaged WebUI checks (113 files / 350 references), i18n and all-file pre-commit passed.
• Local browser with mocked APIs: combined submission, empty/loading/error/retry, keyboard selection, cancel/retry, navigation and narrow viewport passed. Temporary harness removed.

Baseline limitations

Full Python regression: 7,150 passed, 16 failed, 2 collection errors, 59 skipped, 4 xfailed, 6 subtests passed. All 16 failures / 2 errors reproduce on a clean archive of the target branch: optional llama_index, openai_codex and anthropic dependencies are absent locally. Changed-source Pyright reports 15 SDK constructor errors, all reproduced on the target's mpa_tool.py. These checks are not reported as green. Python 3.10 and live cloud creation were not run for this integration.

Detailed evidence: prd-spec/features/studio-mpa-tos-iam/2026-10-12-bucket-only.md and .zh.md.