feat: add observability (APPLICATION_LOGS + USAGE_LOGS + X-Ray + Identity) to MCP server runtimes

## Description

Extend the `RuntimeObservability` construct (created in PR #80) to the MCP server runtimes (source-control, project-management, and any developer MCP servers). Currently only the coding assistant runtime has full observability delivery configured.

## Context

PR #80 deployed the `RuntimeObservability` construct to the coding assistant runtime with 5 delivery pipelines:

| Tab | Log Type | Destination |
|-----|----------|-------------|
| Runtime | `APPLICATION_LOGS` | CloudWatch Logs |
| Runtime | `USAGE_LOGS` | CloudWatch Logs |
| Runtime | `TRACES` | X-Ray |
| Identity | `APPLICATION_LOGS` | CloudWatch Logs |
| Identity | `TRACES` | X-Ray |

The construct is generic — it accepts `runtimeArn` + `runtimeId` and can be applied to any AgentCore runtime. MCP server runtimes need the same observability.

## What to do

Instantiate `RuntimeObservability` in each MCP server stack:

### `lib/nested/source-control-stack.ts`
```typescript
import { RuntimeObservability } from "../constructs/observability/runtime-observability";

// After runtime creation:
new RuntimeObservability(this, "Observability", {
runtimeArn: this.runtimeArn,
runtimeId: ,
});
```

### `lib/nested/project-management-stack.ts`
Same pattern.

### `lib/nested/developer-mcp-stack.ts`
Loop over each developer MCP server runtime and instantiate per-runtime.

## Implementation notes

- The `McpServer` construct (`lib/constructs/runtime/mcp-server.ts`) needs to expose `runtimeId` (currently only exposes `runtimeArn`). Extract it from the CfnResource's `getAtt("AgentRuntimeId")`.
- The MCP server execution role (`mcp-server.ts`) may need the same IAM additions as the coding assistant:
- `bedrock-agentcore:AllowVendedLogDeliveryForResource`
- `cloudwatch:PutMetricData` (namespace: `bedrock-agentcore`)
- The shared Identity log group (`/aws/vendedlogs/bedrock-agentcore/workload-identity-directory/APPLICATION_LOGS/default`) is created idempotently by the custom resource Lambda — no conflict when multiple runtimes deploy the construct.
- Delivery source/destination names are truncated to 49 chars + suffix (≤60 char limit). Verify MCP server runtime IDs fit within this constraint.

## Acceptance Criteria

- [ ] `RuntimeObservability` instantiated for source-control runtime
- [ ] `RuntimeObservability` instantiated for project-management runtime
- [ ] `RuntimeObservability` instantiated for each developer MCP server runtime
- [ ] MCP server execution role has `AllowVendedLogDeliveryForResource` + `cloudwatch:PutMetricData`
- [ ] `McpServer` construct exposes `runtimeId` property
- [ ] `npx cdk synth --quiet` passes
- [ ] All delivery source/destination names ≤60 chars
- [ ] Post-deploy: all MCP server runtimes show log deliveries in AgentCore console (Runtime + Identity tabs)

## Files to modify

```
lib/constructs/runtime/mcp-server.ts MODIFY — expose runtimeId, add IAM
lib/nested/source-control-stack.ts MODIFY — instantiate RuntimeObservability
lib/nested/project-management-stack.ts MODIFY — instantiate RuntimeObservability
lib/nested/developer-mcp-stack.ts MODIFY — instantiate RuntimeObservability per runtime
```

## Constraints

- Do NOT create duplicate Identity log groups — the custom resource handles idempotent creation
- Verify names fit within 60-char limit for each MCP server runtime ID
- The construct is already deployed for the coding assistant — this is additive, no changes to assistant-stack.ts needed