feat(providers): add native options and exact MCP grants (#3025)

* feat(providers): add native options and exact MCP grants

Keep provider policy in provider-owned schemas so unattended Hub runs can grant only requested tools from injected MCP servers. Preserve the native resolved sandbox policy when a workflow override is present, including configured writable roots.

* test(hub): verify real provider tool policy

* test(app): avoid pinning transient restart status

packages/app/e2e/browser/workspace-model-restart.spec.ts

@@ -503,12 +503,16 @@ test.describe("Workspace model restart regressions", () => {
             createdWorkspaceId,
           ]),
         )
-        .toEqual({
-          [seeded.workspaceA]: "running",
+        .toMatchObject({
           [seeded.workspaceB]: "done",
           [createdWorkspaceId]: "done",
         });
 
+      // The restarted provider session may settle while the browser creates the sibling. Its
+      // initial running status is asserted above; this phase verifies that ownership never moves.
+      const workspaceStatuses = await fetchWorkspaceStatuses(client, [seeded.workspaceA]);
+      expect(["running", "done"]).toContain(workspaceStatuses[seeded.workspaceA]);
+
       await expectWorkspaceRowDoesNotShowIndicator(page, {
         serverId,
         workspaceId: seeded.workspaceB,
@@ -519,11 +523,6 @@ test.describe("Workspace model restart regressions", () => {
         workspaceId: createdWorkspaceId,
         indicator: "running",
       });
-      await expectWorkspaceRowInStatusBucket(page, {
-        serverId,
-        workspaceId: seeded.workspaceA,
-        bucket: "running",
-      });
       await expectWorkspaceRowInStatusBucket(page, {
         serverId,
         workspaceId: seeded.workspaceB,