[3/3] Add thin structured-action adapters with explicit resumable conversation binding

[George Ng (GeorgeNgMsft)]

This PR lets Copilot find and run TypeAgent actions directly, passing details such as names, lists, and file paths without turning them into command text. Actions that need permission pause for the user's answer, and Copilot receives the full results or a clear explanation of what failed. It also keeps each connection tied to the right conversation and avoids accidentally repeating an action after a connection drops. Normal natural-language requests and recording commands continue to work through their existing path.

This final layer connects the shared structured-action service to the existing Copilot MCP server, Direct mode's persistent structured bridge, and the native command consumer. Copilot can discover compact summaries, fetch one closed contract, and execute concrete typed inputs without command-string serialization or mandatory status/schema-list stages. Ordinary Direct natural-language prompts and recording directives remain on their existing intent-resolution path. This PR is based on georgengmsft-guarded-action-execution (#2992); it does not supersede or close #2973 by itself.

• Add five fixed tools for search, contract, execute, continue and cancel, preserving fingerprints, full prompts, operation/interaction IDs, all service statuses and actual nested ActionResult data in readable text and structuredContent. Pending interaction is not an MCP error; unsuccessful terminal results remain errors, never invented completion.
• Share a transport-neutral StructuredActionClient across consumers. Each process explicitly joins a concrete dedicated or configured conversation. Resume capabilities remain private, volatile and process-owned; reconnect resumes the same owner or fails explicitly, without replacement ownership or automatic action replay. Public binding metadata is separate from authorization.
• Keep user confirmation in the shared guarded executor, never in adapter defaults. Preserve questions, choices and forms for actual user responses; explicit cancellation remains reachable after switching plugin modes.
• Migrate commandExecutor's generic and known-action convenience paths to the shared service, preserving true resultValue/resultEntity/entities and stable failures instead of reconstructing results from display or lastError.
• Close two integration-discovered lower-service gaps on this branch only: reject the two unsafe setup-capable config bridges before handler entry, and preserve genuine stale/unavailable failures through nested flows, handler suspension and agent RPC. Lost RPC delivery retains execution_uncertain rather than being overwritten by an earlier prompt failure.
• Document Direct/MCP routing, explicit binding, trust boundaries, status/output envelopes, user-response rules, stale refresh and no replay, with a link to the canonical director-actions design.

Validation

• Shared client build and local suite: 137 tests / 7 suites passed.
• Copilot plugin build, bundle and local suite: 106 tests / 13 suites passed, including real MCP SDK in-memory protocol over a real Dispatcher with disposable offline agents.
• Native command consumer build and targeted MCP/schema suites: 24 tests / 2 suites passed.
• Full dispatcher local regression: 2,103 tests / 130 passing suites; one pre-existing skipped suite/test.
• Host binding/join/NL supersession regressions: 37 tests / 5 suites passed. Dispatcher RPC: 19 tests passed.
• Committed-diff lint, complexity (25/30), circular-dependency and test-debt gates passed against both exact layer-2 base eff2a883c63fb96f58909f64657eafefa4bc83eb and ultimate base c9eeb933b317afe2e29a432b325eabf02e8c1871. No new violations, cycles, focused tests or skips. Existing 11 circular baseline exceptions retained. Pinned changed-file formatting passed across the full stack.
• No live email/delete/GUI effects, runtime credentials, global server restarts, or lower-ref edits were used.

Explicit limits

Stdio has no intrinsic Copilot conversation identity. Direct's structured caller is the existing persistent MCP bridge, not the one-shot NL hook. A fresh process cannot recover a previous process's capability from public conversation text. Shutdown does not assert cancellation or rollback. Raw PowerShell flow steps, system.config.toggleAgent, and system.config.enterAgentPriorityMode remain explicitly unsupported on the structured path. Legacy NL interactions cannot be continued with structured operation IDs. The existing unauthenticated loopback host trust model is unchanged.