Security: per-request harness_config overlay allows process spawn via mcp_servers

## Problem

Per-request `harness_config` uses a 2-field blocklist and accepts any `LocalAgentConfig` field, including `mcp_servers`. That lets a client inject an MCP stdio `command` that the SDK spawns at agent start (pre-model, bypasses `run_command` policy) → arbitrary code execution. Default `ax serve` has no auth, so this is pre-auth from the network.

Follow-up to #301 / gap left in #194.

## Proposed fix

Allowlist only safe per-request fields (`model`, `system_instructions`, `response_schema`, `session_continuation_mode`); reject the rest.

**Branch:** https://github.com/qerogram/ax/tree/fix/harness-config-overlay-allowlist
**Diff:** https://github.com/google/ax/compare/main...qerogram:ax:fix/harness-config-overlay-allowlist

`make test` + `make test-python` (56 passed) on that branch.

Auth/TLS and other harnesses are out of scope for this change.

Trace the per-request harness_config overlay into LocalAgentConfig and the MCP server startup path used by ax serve. Run make test and make test-python to establish the current behavior. Done means only model, system_instructions, response_schema, and session_continuation_mode are accepted per request, while other fields are rejected without spawning a process.

Written by the indexing model from the issue text.