Improve managed config authoring and local testing

[rohita5l]

Summary

• separate the admin-authored local draft from per-workspace published-config caches, with atomic writes and digest validation
• add admin-only local draft launches through ucode --local and ucode <agent> --local; normal launches continue to use the published workspace config
• make ucode apply publish the latest draft without requiring a prior test, and remove the managed-config bypass behavior
• streamline the setup wizard and document the draft, test, and publish workflow

Testing

• focused CLI/workflow suite: 228 passed
• full suite: 1,952 passed, 37 skipped, 1 pre-existing local Claude binary capture failure (the binary returned a canned greeting without contacting the capture server)
• Ruff and ty checks passed
• dedicated-workspace E2E: 25 passed, 2 skipped, 3 unrelated live-agent failures: Codex external auth used the globally installed ucode and received 401s; Copilot and Pi received upstream 400s for databricks-grok-4-6

[rohita5l]

Superseded by the reviewer-focused stack:

1. Separate managed config drafts from workspace cache #370 — storage isolation and persistence safety
2. Add admin-only local managed config testing #371 — admin-only local testing and publish policy
3. Streamline the managed config setup wizard #372 — setup wizard presentation

The tip of #372 is identical to the implementation previously proposed here; only the commit and review boundaries changed.