[AgentProfile][cloud] Preserve resolved profile context and explicit tools in conversation builder

Summary

Cloud resolves an AgentProfile into user.agent_settings, but LiveStatusAppConversationService._build_start_conversation_request_for_user then overwrites two resolved profile-owned fields:

configured_agent_settings = user.agent_settings.model_copy(
    update={
        "llm": llm,
        "tools": tools,
        "mcp_config": mcp_config if mcp_config else {},
        "agent_context": AgentContext(
            system_message_suffix=effective_suffix,
            secrets=secrets,
        ),
    }
)

Consequences:

1. OpenHandsAgentProfile.system_message_suffix is resolved into user.agent_settings.agent_context.system_message_suffix, then discarded when the fresh AgentContext is constructed. A cloud profile's personality/instructions do not reach the launched agent.
2. OpenHandsAgentProfile.tools is resolved with tri-state semantics, then discarded by an unconditional get_default_tools(...). An explicit [] or selected list cannot narrow the cloud toolset.
3. Other context fields must be manually reconstructed outside the resolved settings. disabled_skills currently survives only because effective_disabled_skills(user) is threaded through the separate skill-loading path.

The local agent-server profile path does not have this problem: it uses the resolved settings as the base, applies serving-layer additions conditionally, and treats an explicit profile tool list as authoritative.

Expected behavior

The resolved AgentProfile is the base configuration. Cloud-only launch data is additive:

• append request/integration/host suffixes to the profile's existing agent_context.system_message_suffix;
• add secrets without replacing unrelated context fields;
• if user.agent_settings.tools is None, inject the environment-appropriate default/browser set;
• if tools is [] or an explicit list, preserve it exactly;
• preserve current LLM/MCP managed overlays and member/profile disabled_skills behavior.

Acceptance

• A cloud profile with system_message_suffix="PROFILE_SUFFIX" launches with that suffix plus any dynamic request/host suffix.
• A cloud profile with tools=[] remains bare; an explicit list remains exact; tools=None receives the cloud default/browser set.
• Tests exercise the resolved AgentProfile path rather than only a directly constructed global agent_settings path.
• No regression to ACP launches.

Context

• Agent Profile epic: OpenHands/software-agent-sdk#3713
• Tools follow-up: OpenHands/software-agent-sdk#3978
• Cloud implementation: OpenHands/OpenHands#15060
• The client-owned dynamic suffix gap is separate: OpenHands/software-agent-sdk#4029 / PR OpenHands/OpenHands#4030.

Start at LiveStatusAppConversationService._build_start_conversation_request_for_user and trace the resolved AgentProfile path through user.agent_settings. Compare it with the local agent-server profile path, then inspect the existing cloud launch tests and ACP coverage. Done means profile suffix and tri-state tools behavior are preserved, managed overlays and disabled_skills still work, and ACP launches do not regress.