fix(supervisor): preserve MCP versions in runtime config

[shiju-nv]

Summary

Carry the configured MCP version allowlist through YAML and protobuf policy loading into the supervisor's typed L7 endpoint configuration. Reject invalid or ambiguous version configuration during policy activation instead of allowing it to produce an MCP endpoint without L7 inspection.

This is a prerequisite for selecting one permitted MCP version for each request. It does not change request parsing or forwarding behavior.

Related Issue

Related to #2174 and #3092.

Changes

• Add the canonical mcp_versions field to endpoint data produced from YAML and protobuf policies, including the pinned default when no explicit list is configured.
• Parse configured versions into L7EndpointConfig as typed McpProtocolVersion values and require MCP endpoints to have a non-empty, unique list in canonical order.
• Reject malformed, unsupported, duplicate, out-of-order, or non-MCP version configuration during policy activation.
• Reject ambiguous policies that provide both nested mcp.versions and flattened mcp_versions.
• Add focused YAML, protobuf, policy-activation, and typed-configuration tests.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[johntmyers]

gator-agent

PR Review Status

This focused policy/runtime change is project-valid, but the initial review found one compatibility regression in MCP version validation.

Action required: @shiju-nv, make MCP protocol matching case-insensitive at the new version-validation boundary and add mixed-case YAML and protobuf regression coverage.

Blocking findings:

• GATOR-a6d4dc0e-01: mixed-case MCP protocol spellings can now make policy activation fail.

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: Focused supervisor/policy prerequisite for accepted MCP version-profile work in #2174
• Docs: Not needed; this patch carries already-documented internal runtime metadata and does not change the user-facing contract
• Checks: DCO, vouch, Branch Checks, and Helm gate are green for the current head; required E2E dispatch waits for review feedback
• E2E: test:e2e is required for policy enforcement/supervisor behavior but has not been dispatched while the blocker remains
• Head SHA: a6d4dc0e7231efe8f1fcbbaa83f10a837e3eea61
• Base SHA: 592df3e01489b3fd2af5573e1feb043108596aed
• Merge base SHA: 592df3e01489b3fd2af5573e1feb043108596aed
• Patch ID: 6e491b076331776f41e4cd72cc46bc28ca56b416
• Gator payload: 8
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied for dab4e69. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

Thanks @shiju-nv. I reviewed head dab4e69a4b62b100c816498c8286d36385fdaece; the parsed L7Protocol::Mcp comparison restores case-insensitive validation, and the new YAML and protobuf cases cover the mixed-case paths requested in the prior review. The carried finding is resolved, and the independent follow-up review found no new blocking issues.

Blocking findings:

• No blocking findings remain

Carried findings:

• GATOR-a6d4dc0e-01: resolved by the current head; the Gator-owned review thread has been resolved

Gator metadata

• Validation: Focused supervisor/policy prerequisite for accepted MCP version-profile work in #2174
• Docs: Not needed; this patch carries internal runtime metadata and does not change the user-facing contract
• Checks: Current-head Branch Checks and Helm gate are green; E2E is queued
• E2E: test:e2e applied; E2E Label Help required rerunning current-head run 33986107128, which is queued
• Head SHA: dab4e69a4b62b100c816498c8286d36385fdaece
• Base SHA: 592df3e01489b3fd2af5573e1feb043108596aed
• Merge base SHA: 592df3e01489b3fd2af5573e1feb043108596aed
• Patch ID: bd8de98fbbe374cee8a229cbae3f8819110250d9
• Gator payload: 8
• Review mode: follow_up
• Previous reviewed SHA: a6d4dc0e7231efe8f1fcbbaa83f10a837e3eea61
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline