Make omitted Gateway protocolType mean unrestricted

### Description

Make an omitted Gateway `protocolType` consistently mean an unrestricted
Gateway across the old CLI, project schema, and L3 construct.

The current project contract has an unintuitive compatibility mapping:

| `agentcore.json` value | Current behavior |
| --- | --- |
| omitted | MCP-only |
| `"MCP"` | MCP-only |
| `"None"` | unrestricted; L3 omits the service field |

The AgentCore service itself uses omission for an unrestricted Gateway and
explicit `"MCP"` for an MCP-only Gateway. The CLI contract should align:

| `agentcore.json` value | Desired behavior |
| --- | --- |
| omitted | unrestricted |
| `"MCP"` | MCP-only |
| `"None"` | accepted as a legacy unrestricted value |

The command experience should be:

```bash
# Unrestricted; protocolType omitted
agentcore add gateway --name tools

# MCP-only
agentcore add gateway --name tools --protocol-type MCP
```

This needs a coordinated compatibility migration. Existing schema-v1 projects
with omitted `protocolType` historically mean MCP, and imported MCP Gateways are
currently persisted with the field omitted. Those projects must not silently
become unrestricted when the L3 default changes.

This was intentionally deferred from aws/agentcore-cli#2028 so that PR can
preserve the currently published schema and L3 behavior.

### Acceptance Criteria

- [ ] Omitting `--protocol-type` in the old CLI persists no `protocolType` field and deploys an unrestricted Gateway.
- [ ] `--protocol-type MCP` persists `"protocolType": "MCP"` and deploys an MCP-only Gateway.
- [ ] The old CLI no longer needs customers to pass `--protocol-type None`; existing `"None"` project values remain valid.
- [ ] Importing an MCP Gateway persists explicit `"protocolType": "MCP"`.
- [ ] Existing projects where omission historically meant MCP are migrated or normalized to explicit `"MCP"` before consuming the new L3 behavior.
- [ ] The L3 treats omitted `protocolType` as unrestricted and explicit `"MCP"` as MCP-only.
- [ ] Semantic-search protocol configuration remains usable on unrestricted Gateways when supported by the service.
- [ ] The old CLI, project-based refactor, schema copies, generated CDK, and L3 tests use the same contract.
- [ ] Release sequencing publishes the compatible L3 version before either CLI updates its exact L3 pin.
- [ ] Regression tests prove existing MCP projects do not silently widen to unrestricted access.

### Additional Context

This is a cross-repository compatibility change involving:

- old CLI authoring, import, migration, generated CDK, and dependency pinning;
- project-based refactor command and schema behavior;
- `aws/agentcore-l3-cdk-constructs` schema and Gateway synthesis.

Start by tracing the old CLI authoring and import paths, the project-based refactor and schema copies, and the AgentCore L3 Gateway synthesis and tests. Review the migration and dependency-pinning requirements before changing behavior. Done means all listed acceptance criteria pass, including regression coverage proving existing MCP projects remain restricted.

Written by the indexing model from the issue text.