repository prebake for agent runtimes

[zreigz]

Test Plan

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• I have added tests to cover my changes.
• If required, I have updated the Plural documentation accordingly.

[linear]

PROD-5150

[greptile-apps]

Greptile Summary

The PR synchronizes the AgentRuntime CRD with repository prebaking and expanded runtime configuration.

• Adds repositoryImage for prebaked repository OCI images.
• Adds configurable remote MCP servers, headers, and tool allowlists.
• Refreshes generated runtime and embedded Kubernetes PodSpec schema fields.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to reject malformed MCP endpoint URLs during admission.

The new MCP server URL schema accepts any nonempty string even though downstream configuration requires a usable HTTP endpoint, deferring a readily detectable configuration error.

Files Needing Attention: charts/deployment-operator/crds/deployments.plural.sh_agentruntimes.yaml

Important Files Changed

Filename	Overview
charts/deployment-operator/crds/deployments.plural.sh_agentruntimes.yaml	Adds repository prebaking and remote MCP configuration to the public AgentRuntime schema; the MCP endpoint currently admits malformed non-HTTP values.

_{Reviews (1): Last reviewed commit: "repository prebake for agent runtimes" | Re-trigger Greptile}

[greptile-apps]

MCP endpoint lacks URL validation

The schema accepts any nonempty mcpServers[].url, including malformed or non-HTTP values, even though the field requires a remote streamable HTTP endpoint. This defers a detectable configuration error until reconciliation or agent execution and leaves the configured MCP server unavailable.

Knowledge Base Used:

• Operator custom resource APIs
• Agent execution APIs