Python Bug in azure-ai-agentserver-responses: MCP Tool OBO Token Exchange Fails When Agent is Deployed to Azure AI Foundry

## Summary

When using `FoundryChatClient.get_mcp_tool()` to attach a Foundry MCP server that requires OAuth (Work IQ User / `mcp_MeServer`) to an agent, the tool works correctly **locally** via `agent-framework` directly, but **fails with an OBO token error** when the same agent is deployed as a hosted agent on Azure AI Foundry Agent Service.

## Environment

| Package | Version |
|---------|---------|
| `azure-ai-agentserver-responses` | 1.0.0b5 |
| `agent-framework` | 1.2.2 |
| `agent-framework-openai` | 1.2.2 |
| `agent-framework-foundry` | 1.2.2 |
| `agent-framework-foundry-hosting` | ≥1.0.0a260429 |
| `azure-ai-projects` | ≥2.1.0 |
| `azure-identity` | ≥1.26.0b1 |
| Python | 3.12 |
| Container base | `python:3.12-slim` |
| Foundry protocol | Responses API v1.0.0 |

## Error

When the deployed agent invokes the MCP tool, the following exception is raised:

```
agent_framework.exceptions.ChatClientException: (
' service failed to complete the prompt:
Failed to fetch access token. Status: BadRequest.
Details: "ARA OBO token request failed with status BadRequest"',
APIError('Failed to fetch access token. Status: BadRequest.
Details: "ARA OBO token request failed with status BadRequest"')
)
```

## Reproduction

### Agent setup (simplified)

```python
# agent.py
from azure.identity.aio import DefaultAzureCredential
from agent_framework import Agent
from agent_framework.foundry import FoundryChatClient

def create_orchestrator_agent() -> Agent:
credential = DefaultAzureCredential()

client = FoundryChatClient(
project_endpoint="https://",
model="",
credential=credential,
)

mcp_tool = FoundryChatClient.get_mcp_tool(
name="WorkIQUser",
url="https://agent365.svc.cloud.microsoft/agents/servers/mcp_MeServer",
project_connection_id="",
approval_mode="never_require",
)

return Agent(
client=client,
name="MyAgent",
instructions="You are a helpful assistant. Use the MCP tool to get the user's profile.",
tools=[mcp_tool],
)
```

### Container entrypoint (simplified)

```python
# container.py
import asyncio
from agent_framework_foundry_hosting import ResponsesHostServer
from agent import create_orchestrator_agent

async def main():
orchestrator = create_orchestrator_agent()
server = ResponsesHostServer(orchestrator)
await server.run_async()

if __name__ == "__main__":
asyncio.run(main())
```

### Hosted agent deployment

```python
from azure.ai.projects import AIProjectClient
from azure.ai.projects.models import (
HostedAgentDefinition,
ProtocolVersionRecord,
AgentProtocol,
)

client = AIProjectClient(
endpoint="",
credential=credential,
allow_preview=True,
)

agent = client.agents.create_version(
agent_name="my-agent",
definition=HostedAgentDefinition(
container_protocol_versions=[
ProtocolVersionRecord(protocol=AgentProtocol.RESPONSES, version="1.0.0"),
],
image=".azurecr.io/my-agent:",
environment_variables={...},
tools=[
{
"type": "mcp",
"server_label": "WorkIQUser",
"server_url": "https://agent365.svc.cloud.microsoft/agents/servers/mcp_MeServer",
"project_connection_id": "",
}
],
),
)
```

### Invocation (triggers the error)

```python
openai_client = client.get_openai_client(agent_name="my-agent")

# This call triggers the MCP tool, which fails with OBO error
response = openai_client.responses.create(
input=[{"type": "message", "role": "user", "content": "What is my email?"}],
)
```

## Works locally

Running the same agent directly via `agent-framework` locally works without error:

```python
# interactive.py or notebook
orchestrator = create_orchestrator_agent()
session = orchestrator.create_session()

# MCP tool call succeeds — DefaultAzureCredential resolves to user's Azure CLI token
result = await orchestrator.run("What is my email?", session=session)
print(result.text) # ✓ Returns user profile from Graph API
```

## Expected behavior

The MCP tool should successfully acquire an OBO token and call the MCP server (`mcp_MeServer`) to retrieve the user's Graph API profile, the same way it works when running agent-framework locally.

## Questions

1. What OAuth/app registration configuration is required for hosted agent MCP tools to perform OBO token exchange successfully?
2. Is there a known limitation with OBO token exchange for MCP tools in hosted agents?

Beginne mit der Reproduktion in agent.py und container.py und vergleiche dann die lokale Ausführung von agent-framework mit dem Aufruf der gehosteten Responses API im Bereitstellungsbeispiel. Untersuche den OBO-Token-Austausch für das MCP-Tool sowie die aufgeführten Azure-Pakete und -Versionen. Als erledigt gilt, wenn die erforderliche Konfiguration des gehosteten Agents identifiziert oder eine Einschränkung bestätigt wurde und der fehlschlagende Aufruf behoben oder die Einschränkung dokumentiert ist.

Vom Indexierungsmodell aus dem Issue-Text verfasst.