Bound and cancel MCP proxy discovery during session startup

## Summary

`discoverMCPServers()` performs MCP proxy health and server-list requests sequentially. The health request can consume five seconds and the list request can then consume another ten seconds. Callers cannot cancel the operation, and an unavailable or transiently failing proxy is returned as the same empty configuration as a healthy proxy with no configured servers.

Discovery should have one caller-controlled cancellation and deadline contract so startup cannot continue doing work after its caller has abandoned the session.

## Current behavior

In `src/mcp-proxy.ts`:

1. `discoverMCPServers()` awaits `isMCPProxyAvailable()`.
2. Only after that request succeeds does it request the server list.
3. Each request owns a separate timeout, making the total wait additive.
4. The public function does not accept an `AbortSignal` or deadline.
5. Proxy unavailability and a valid empty server list both produce an empty object.

This behavior can add the full health timeout and list timeout to a startup path. It also leaves no structured way for callers to distinguish a valid empty configuration from discovery that could not complete.

## Expected behavior

- Callers can cancel discovery through the SDK API.
- Health and list discovery share one overall time budget rather than independent additive budgets.
- Cancellation stops the active fetch and does not leave a timer or request running.
- A valid empty server list remains a successful result.
- Consumers have a documented way to observe that discovery was unavailable, cancelled, timed out, or invalid without parsing log output.
- Existing consumers that rely on the convenience API can migrate without an unrelated MCP configuration rewrite.

## Reproduction and test cases

Add deterministic tests for:

- Healthy proxy with one server.
- Healthy proxy with an empty server list.
- Health endpoint that never responds.
- List endpoint that never responds after a successful health check.
- Cancellation during health discovery.
- Cancellation during list discovery.
- Connection failure, non-success response, and malformed response body.

The elapsed time test should prove that one overall deadline is enforced rather than the sum of two request timeouts.

## Proposed scope

- Add caller cancellation and an overall discovery deadline.
- Define how discovery outcome is reported without conflating a valid empty list with failure.
- Preserve the current conversion from discovered proxy entries to Copilot SDK MCP server configuration.

## Non-goals

- Caching MCP discovery results.
- Adding a general retry policy.
- Changing the MCP proxy protocol.
- Changing MCP authentication behavior.
- Adding GitHub App-specific startup behavior to this SDK.

## Acceptance criteria

- A caller can abort either discovery request.
- One elapsed-time budget bounds the full operation.
- Tests distinguish valid-empty, unavailable, timed-out, cancelled, and invalid-response outcomes.
- No request or timeout remains active after cancellation.
- The API and migration behavior are documented.

從 src/mcp-proxy.ts 中的 discoverMCPServers()、isMCPProxyAvailable() 和伺服器清單請求流程開始。為兩次請求中的 discovery 加入對健康、為空、無法使用、無效、逾時和已取消狀態的決定性涵蓋，其中包括一個整體期限以及取消後的清理。完成的標準是呼叫端能夠觀察到不同的結果，同時繼續支援現有的 MCP 設定轉換和 convenience API 遷移。

由索引模型根據 Issue 內容生成。