fix(backend/copilot): hide builder-blocked MCP tools so the SDK can't auto-deny them (#13167)

## Why

Production AutoPilot/Copilot chats that originate from the **builder
panel** (a chat embedded inside `/build` that is bound to a specific
graph via `session.metadata.builder_graph_id`) have been completely
stalling out for some users. Symptom from three reproduced sessions:

- Model reaches for `mcp__copilot__get_agent_building_guide` (or
`mcp__copilot__create_agent`).
- Tool result comes back as the literal string `Permission to use
mcp__copilot__... has been denied.` (length 73 / 61 — exact match for
the canned string baked into the Claude Code CLI binary).
- Model then narrates a Claude-Code-style Allow/Deny prompt to the user
("click Allow…") — UI that **does not exist** in the builder chat.
- User can't unstuck it. Churn.

Root cause is two-fold:

1. `BUILDER_BLOCKED_TOOLS = ("create_agent", "customize_agent",
"get_agent_building_guide")` is correct — the panel is already bound to
a graph, so minting a new one is wrong and the building guide is already
in the cacheable system-prompt suffix. But these tools were only added
to `disallowed_tools` while the MCP server kept advertising them, so the
model kept reaching for them and the SDK kept synthesising the deny
string.
2. The system prompt for builder mode never explicitly said "use
`edit_agent` against the bound graph, even when it's empty" — so on
empty (v1, 0 nodes) graphs the model picked `create_agent` instead of
`edit_agent`.

## What

- `create_copilot_mcp_server` now accepts `hidden_tool_names`; tools in
that set are not registered at all, so the model never sees them.
- `stream_chat_completion_sdk` derives the hidden set from the active
`CopilotPermissions` and passes it through.
- `build_builder_system_prompt_suffix` gains a `<tool_usage>` block
telling the model to use `edit_agent` on the bound graph, that
`create_agent`/`customize_agent`/`get_agent_building_guide` are
unavailable, and explicitly that **there is no permission prompt UI** in
the builder chat (so don't ask the user to "click Allow").

## How

- `tool_adapter.create_copilot_mcp_server(hidden_tool_names=...)`
filters `TOOL_REGISTRY` at MCP registration time.
`allowed_tools`/`disallowed_tools` alone are insufficient because the
CLI auto-rejects denied calls with a hardcoded "Permission to use ...
has been denied" string that the model misreads as an interactive
permission gate.
- `sdk/service._hidden_short_names_for_permissions` computes
`ALL_TOOL_NAMES - effective_allowed_tools(...)` — anything excluded by
the active permissions is hidden from the MCP server too.
Non-permissioned sessions get an empty hidden set (no behaviour change).
- `builder_context._BUILDER_TOOL_GUIDANCE` is appended inside the
existing `<builder_session>` suffix (still cacheable; no per-turn
variability), keeping the prompt cache warm.

## Test plan

- [x] `pytest backend/copilot/sdk/tool_adapter_test.py
backend/copilot/builder_context_test.py
backend/copilot/permissions_test.py backend/copilot/sdk/service_test.py`
— 223 pass
- [x] New tests: `TestCreateCopilotMcpServerHidden` (3 cases, including
a regression for `BUILDER_BLOCKED_TOOLS`) and
`test_system_prompt_suffix_steers_to_edit_agent`
- [ ] `/pr-test` against the consolidated preview to confirm a
builder-bound empty graph no longer churns when the user asks for help
building