feat(studio): authenticate TOS output mounts with IAM roles

[PolarisCzh]

Summary

• Replace Studio MPA's TOS AK/SK form with an optional bucket selector using the actual Worker Tool IAM Role.
• Limit Studio choices to agentkit-platform- buckets. Filter before search/count/pagination and validate again before cloud calls; safely reject old credential payloads and remove stale draft credentials.
• Verify bucket ownership/region and Role trust, then additively ensure bucket HeadBucket/ListBucket and object GetObject/PutObject/DeleteObject/AbortMultipartUpload permissions scoped to that bucket's sandbox-session/*. Preserve existing bindings and reject conflicting policy documents.
• Send TOS_CREDENTIAL_TYPE_IAM_ROLE without Credentials; retain read/write /data/output and existing per-session mount paths. Keep standalone CLI/YAML access-key mode and unfiltered general resource queries compatible.
• Update bilingual requirements/specs/operator docs, regression tests and matching generated WebUI assets.

Upstream scope

This branch is based directly on official main at 812faadf, not on the fork's divergent history. It transfers only the TOS Role feature and its evidence, preserving official model-key discovery and provider behavior. Generated assets were rebuilt from official-base sources. Two TOS ordering cases now isolate the new upstream model-key dependency while retaining their grant-order/error assertions.

The existing fork PR superops-team/veadk-python#24 remains unchanged. This PR has one feature commit and does not import unrelated fork commits.

Verification on the official-base port

• Python 3.12.12 targeted suite: 872 passed.
• Frontend: 1,377 Node tests + 75 Vitest cases passed; build, i18n and packaged asset checks passed.
• Repository-pinned Ruff 0.11.12 and pre-commit (including secret scans): passed.
• Executable changed-line coverage versus official main: 100%, Python 102/102 and TS 10/10, measured using coverage.py XML and Istanbul Clover XML.
• Full Python regression: 6,950 passed, 16 failed, 2 collection errors, 59 skipped, 4 xfailed, 6 subtests passed. The failures were reproduced against an isolated official-main archive with the same interpreter: six Harness cases need optional llama_index, ten Codex cases need optional openai_codex, and two self-host collection errors need optional anthropic. These checks are not reported as green.
• Pyright: 15 legacy SDK call-signature errors in mpa_tool.py, also reproduced in the original official-main file; other changed production Python files have no diagnostics.

Existing live feature evidence and its boundary

The original fork implementation was deployed to an existing Studio as V42 with unchanged environment/branding. A test MPA was created from the remote Studio using bucket-only IAM Role configuration. Runtime/Worker readiness, the exact Tool credential mode, IAM policy readback, actual /data/output writes, independent TOS reads, browser download hash equality and two-session same-name-file isolation were verified.

That evidence belongs to the original fork implementation. This official-base port has not been redeployed or browser/cloud E2E-tested, and no Runtime/Worker image was rebuilt in this PR task. It does not change login, JWT/KeyAuth, Worker protocol, existing Sessions or cloud resources.

Security/compatibility notes

• Shared-role consumers have the same role permissions. Additive reconciliation does not remove pre-existing grants; per-session directories are not tenant authorization boundaries.
• Old Studio requests containing TOS credential fields must refresh to the new bucket-only client.
• KMS-encrypted buckets, explicit Deny policies, independent principals and business-channel delivery are not covered by the live test.

Design and evidence: English PRD | 中文 PRD