fix(workspace): skip MCP gateway bootstrap when unused

[HsbcJone]

Summary

Fixes #2113.

SandboxedWorkspaceBase.initialize() treated the in-sandbox MCP gateway as part of every sandbox, so workspaces that only need Bash, file tools, and Skills still installed a gateway virtualenv and health-checked FastAPI.

This change splits Glob/Grep system bootstrap from the MCP gateway lifecycle:

• _system_bootstrap_commands() / _ensure_system_runtime() still install ripgrep and the Glob helper on every initialize().
• The gateway virtualenv, process, and health check run during initialize() only when default_mcps is non-empty or the restored .mcp file lists at least one server.
• The first add_mcp() starts the gateway once (concurrent callers share that start; a failed start can be retried).
• list_mcps() returns [] when no gateway exists; remove_mcp(), reset(), and close() stay valid in that case.
• OpenSandbox, E2B, Daytona, Kubernetes, Apple Container, and Bubblewrap all use the same split.

Changes

• Separate system runtime bootstrap from MCP gateway setup in SandboxedWorkspaceBase
• Update OpenSandbox / E2B / Daytona / K8s / Apple Container / Bubblewrap workspaces accordingly
• Extend Daytona / Bubblewrap / Apple Container tests for the new lifecycle

How I tested this

pytest tests/workspace_daytona_test.py tests/workspace_bubblewrap_test.py tests/workspace_applecontainer_test.py tests/workspace_docker_build_test.py tests/workspace_local_test.py tests/workspace_prewarm_test.py tests/workspace_skill_archive_test.py

158 passed, 31 skipped (existing live Docker/E2B/Daytona/Kubernetes/Bubblewrap/Apple Container suites).

black, flake8, and pylint (10.00/10) on the changed files; mypy on _base.py and _sandboxed_base.py reported no issues.

Checklist

• Informative title for release notes
• Single goal
• Style checks on changed files
• Tests updated / added
• Docs (N/A for this internal workspace lifecycle change)