feat(callout): route MCP exchanges through filtered subrequests

[leseb]

Parent: #879

Depends on praxis-proxy/praxis#1074 and praxis-proxy/praxis#1092. The reusable executor was introduced by praxis-proxy/praxis#1073.

Summary

MCP HTTP exchanges currently use a transport path that does not run through a configured outbound filter chain. Adopt the filtered-subrequest executor for the complete MCP HTTP and session lifecycle.

User-scoped credential and attribution policy remains tracked separately in #880.

Scope

• Implement an rmcp::transport::streamable_http_client::StreamableHttpClient adapter backed by the filtered-subrequest executor.
• Route initialization, notifications, tools/list pagination, tools/call, SSE/GET streams, and session cleanup through the configured outbound chain.
• Add an outbound-chain reference to the relevant MCP configuration.
• Preserve session headers, operation-wide deadlines, response-size limits, pagination limits, cancellation, and cleanup behavior.
• Preserve destination authority, DNS/SSRF validation, TLS/SNI, and Host handling.
• Keep existing static MCP credentials working; request-scoped credential projection is handled by feat(agentic): propagate user-scoped callout credentials and attribution #880.

Acceptance Criteria

• No MCP HTTP exchange bypasses the configured outbound chain.
• Buffered, streaming, pagination, and session-cleanup paths all use the same executor-backed adapter.
• Rejection, timeout, cancellation, malformed response, and response-size outcomes retain their current behavior.
• Configuration validation fails when the outbound chain cannot be built.
• Unit tests cover the adapter with controlled transports.
• Integration tests prove an observable outbound filter runs for MCP initialization, tool discovery, tool calls, streaming, and cleanup.