Harden cloud provider orchestration runtime fallback

[dragonforce2010]

Summary

• add follow-up cloud runtime deployment hardening for veFaaS stable updates and env cleanup
• add controlled runtime-tool fallback for agent-runtime and host workspace paths
• keep cloud smoke deterministic via opt-in protocol/env while production stable env drops smoke overrides
• fix E2E cleanup so host fallback runtime ids are not treated as real E2B sandboxes

Verification

• bun run typecheck
• bun run test:e2e
• bun run ci:contracts
• bun run lint
• bun run build
• bun run deploy:vefaas:stable
• MAPLE_CLOUD_BASE_URL=https://sd8ihq8v316pc5mf9c1j0.apigateway-cn-beijing.volceapi.com MAPLE_CLOUD_AGENT_LOOP_PROTOCOL=cli_batch bun run test:cloud-min-story

Resource cleanup

• No real Aliyun FC/OSS resources were created by the verification path; Aliyun coverage uses contract fakes and signed URL checks.
• Test veFaaS runtime functions from prior cloud smoke were scaled down before this follow-up.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c5e2681b6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Carry Aliyun FC pool auth into provisioned members

When an Aliyun FC runtime pool uses an existing HTTP endpoint, this path only reads process-wide MAPLE_ALIYUN_FC_* values and later persists member config without the per-workspace/pool invoke_url, function_name, or api_key from runtime_pools[].config / provider_credentials.aliyun. In tenant-scoped deployments where those values are stored on the workspace rather than the API process, provisioning either marks every Aliyun member failed for missing MAPLE_ALIYUN_FC_INVOKE_URL, or sessions run against protected FC endpoints without the Authorization header because runtimePoolMemberAgentRuntime can only reconstruct the runtime from member config_json.

Useful? React with 👍 / 👎.