test(e2e): cover forced MCP rebuild with unavailable sandbox exec

## Problem

The forced managed-MCP rebuild recovery added in #7196 is covered by focused unit and integration tests, and the protected MCP E2E lane passes. The live suite does not yet fault-inject the specific boundary where a sandbox remains registered but its exec relay is unavailable before `rebuild --force`.

Without that case, a future mismatch between control-plane state and host-side MCP intent recovery could escape live regression coverage.

## Acceptance criteria

- Add a deterministic live fixture that preserves sandbox registration while making sandbox exec unavailable.
- Run `rebuild --force` with a managed MCP server configured.
- Verify the replacement sandbox is recreated successfully.
- Verify provider registration, policy, adapter state, and managed MCP intent are restored.
- Prove a post-rebuild authenticated MCP operation succeeds.
- Keep credentials redacted from logs and artifacts.
- Ensure cleanup restores the fault-injection mechanism on failure.

## Context

Follow-up coverage for the non-blocking automated review warning on #7196. The implementation PR remains independently reviewable because its focused tests and currently selected protected E2E jobs are green.