test(e2e): cover forced MCP rebuild with unavailable sandbox exec

[apurvvkumaria]

Problem

The forced managed-MCP rebuild recovery added in #7196 is covered by focused unit and integration tests, and the protected MCP E2E lane passes. The live suite does not yet fault-inject the specific boundary where a sandbox remains registered but its exec relay is unavailable before rebuild --force.

Without that case, a future mismatch between control-plane state and host-side MCP intent recovery could escape live regression coverage.

Acceptance criteria

• Add a deterministic live fixture that preserves sandbox registration while making sandbox exec unavailable.
• Run rebuild --force with a managed MCP server configured.
• Verify the replacement sandbox is recreated successfully.
• Verify provider registration, policy, adapter state, and managed MCP intent are restored.
• Prove a post-rebuild authenticated MCP operation succeeds.
• Keep credentials redacted from logs and artifacts.
• Ensure cleanup restores the fault-injection mechanism on failure.

Context

Follow-up coverage for the non-blocking automated review warning on #7196. The implementation PR remains independently reviewable because its focused tests and currently selected protected E2E jobs are green.