Add ucode export for managed config JSON

[david-siqi-liu]

Adds a role-agnostic ucode export that serializes the workspace's local managed coding-agent config to a portable JSON that a future ucode publish -f <path> will consume. It is read-only and offline: no auth, no admin check, no discovery, no publish, and the only write is the optional output file.

The output leads with the source workspace URL and a spec_version (the export format version), followed by the external CodingAgentConfig.

Changes

• New managed_export.py: validate through validate_manifest, serialize through serialize_managed_config, strip the server-owned resource name, and prefix the source workspace and spec_version. Writes to stdout (one trailing newline, nothing else) or atomically to --output/-o (temp file in the destination dir + os.replace, no parent-dir creation, temp cleaned up on failure, existing file replaced without --force, ~ expanded).
• Wire ucode export in cli.py; diagnostics and errors go to stderr, nonzero exit on failure.
• Document ucode export in the README.
• Tests: envelope order (workspace, then spec_version), stdout/file byte-identity, empty stdout in file mode, atomic replace, validation and write-failure paths, no auth/admin lookup, admin vs non-admin parity, and a config round-trip through the canonical parser and validator.

Credentials and runtime state are excluded via the existing serializer (it omits internal resource ids, timestamps, and user ids); the resource name is stripped on top. The source workspace URL is included by design. Agent custom_headers are preserved so the config round-trips through publish.

Validation

Verified end to end against a real workspace across three configs: agents-only, agents + MCP servers, and agents + a tiered spend policy. In file mode stdout is left empty and the bytes match stdout mode; ~ in the output path is expanded. Example output (identifiers replaced with placeholders):

{
  "workspace": "https://<workspace-host>",
  "spec_version": 1,
  "default_agent": "CODING_AGENT_CLAUDE_CODE",
  "enabled_agents": [
    {
      "agent": "CODING_AGENT_CODEX",
      "config": {
        "use_as_global_settings": false,
        "model_config": { "codex": { "default_model": "system.ai.gpt-5" } }
      }
    },
    {
      "agent": "CODING_AGENT_CLAUDE_CODE",
      "config": {
        "use_as_global_settings": false,
        "model_config": {
          "claude": {
            "default_model": "system.ai.claude-opus-5",
            "models": {
              "default_fable_model": "system.ai.claude-fable-5",
              "default_opus_model": "system.ai.claude-opus-5",
              "default_sonnet_model": "system.ai.claude-sonnet-5",
              "default_haiku_model": "system.ai.claude-haiku-4-5"
            }
          }
        }
      }
    }
  ],
  "mcp_servers": [
    { "name": "databricks-sql", "type": "MCP_SERVER_TYPE_DATABRICKS_SQL" },
    { "name": "system-ai-github", "type": "MCP_SERVER_TYPE_UC_SERVICE" },
    { "name": "system-ai-genie_one", "type": "MCP_SERVER_TYPE_UC_SERVICE" }
  ],
  "budget_policy": {
    "display_name": "coding-agents-tiered-routing",
    "budget_id": "00000000-0000-0000-0000-000000000000",
    "tiers": [
      { "spending_percentage": 0.5, "default_agent": "CODING_AGENT_CLAUDE_CODE", "default_model": "system.ai.claude-sonnet-5" },
      { "spending_percentage": 0.8, "default_agent": "CODING_AGENT_CLAUDE_CODE", "default_model": "system.ai.claude-haiku-4-5" }
    ]
  }
}

This pull request and its description were written by Isaac.

[rohita5l]

LGTM. config needs the first field as spec_version and version needs to be 1