ServiceRequestError: Bearer token authentication is not permitted for non-TLS protected (non-https) URLs when calling Azure AI Search from LangGraph agent deployed as Foundry Hosted Agent using Managed Identity

When a LangGraph agent is deployed as a Foundry Hosted Agent (using ResponsesHostServer + azd deploy), calling SearchClient.search() from inside a LangGraph @tool using DefaultAzureCredential() (Managed Identity) throws the following error at runtime. The exact same code works correctly when run locally using az login credentials.

**What we have confirmed**

AZURE_SEARCH_ENDPOINT is https:// — confirmed via env var inspection
Same code works locally with az login credentials
Search Index Data Reader role assigned to the agent Managed Identity on the Search resource
The Search resource is in a different resource group than the Foundry project but same subscription
OpenAI calls from the same container work correctly with the same DefaultAzureCredential() pattern
Error occurs specifically when SearchClient.search() is called at request time — not at SearchClient initialization

**Expected behavior**

SearchClient.search() should successfully authenticate using the container's Managed Identity and return search results — same as it does locally with az login.

**Actual behavior**

ServiceRequestError is thrown indicating a non-https URL — even though the endpoint is confirmed https. Suspected cause: Managed Identity token acquisition may be failing silently and Azure SDK is falling back to an unauthenticated http redirect URL.