ChatAllowedMcpServers enterprise policy is not enforced for agent-host (delegated) chat sessions

Does this issue occur when all extensions are disabled?:No

- VS Code Version: 1.130.0
- OS Version: macOS 15

**Bug - enterprise policy / MCP governance**
The `ChatAllowedMcpServers` policy (added in #326226) is deployed via managed
settings (macOS configuration profile / Windows registry) with a single allowed
stdio command, e.g.:
"ChatAllowedMcpServers": [
{ "serverCommand": ["npx", "--yes", "my-approved-mcp-server"] }
]
Confirmed applied via `Developer: Policy Diagnostics` (shows the resolved value)
and it behaves correctly for the built-in agent.

### Steps to reproduce
1. Apply the policy above so only the one approved `serverCommand` is allowed.
2. Add a second, non-approved MCP server to `mcp.json` (any other stdio command,
or a marketplace-installed MCP server).
3. In a chat session using the **local** agent, ask the model to call a tool
from the non-approved server.
→ Correctly **blocked**: the server never connects and the tool call is
rejected ("blocked by policy").
4. Switch the same session to the **delegated agent-host runtime** (the
"Local" → Copilot session toggle; the agent-host integration from #320854).
5. Ask for the same tool call again.
**Expected**
The `ChatAllowedMcpServers` allowlist should apply regardless of which runtime
executes the session. The non-approved server should be blocked in the
agent-host session exactly as it is in the local agent.
**Actual**
In the delegated agent-host session the non-approved MCP server **connects and
its tools are fully callable** - the allowlist is not consulted. `MCP: List
Servers` for the agent-host session shows the non-approved server as **Running**.
Removing the policy makes no difference; re-selecting the local agent blocks it
again.
### Impact
`ChatAllowedMcpServers` is an enterprise **security** control. Any user can
bypass it - and run an otherwise-blocked MCP server - with a single click that
delegates the session to the agent host. Administrators have no way to detect or
prevent this from the policy artifacts themselves.
### Related
- #326226 (added the `ChatAllowedMcpServers` / `ChatDeniedMcpServers` policies)
- #320854 (agent-host session MCP integration)