feat: harden automation draft preflight validation

[KirschBluteX]

Why

Automation draft validation currently checks schema, schedules, and event triggers, but it cannot verify the deployment resources a selected automation actually needs. A draft can therefore reach creation with a missing credential, unusable MCP integration, or inaccessible repository.

Related to OpenHands/OpenHands#16565.

Summary

• extend the existing /v1/validate owner with optional, bounded integration requirements while preserving legacy clients that omit them
• verify secret names, stored MCP availability/connectivity, and Cloud or local repository/ref access without returning secret values or provider response bodies
• bound the complete validation flow to 60 seconds, give MCP probes their own HTTP budget, and paginate credential/repository/ref lookup for at most ten pages with repeated-token detection
• require provider URLs to use the official host and return field/step-addressable errors plus sanitized 503 responses for dependency, transport, rate-limit, pagination, and malformed-response failures

How to test

• python -m pytest tests/test_capabilities_router.py -q — 35 passed
• pre-commit run --files openhands/automation/schemas.py openhands/automation/capabilities_router.py tests/test_capabilities_router.py — Ruff format/lint, pycodestyle, and Pyright passed

The tests cover successful validation, multiple prerequisite errors, secret-name-only requests, Cloud and local repository checks across later pages, repeated pagination tokens, provider-host validation, total and MCP-specific deadlines, sanitized dependency failures, and malformed requirement bounds.

Companion changes

• Agent Canvas: feat: harden automation preflight validation OpenHands#16614
• Software Agent SDK: feat: add repository access preflight software-agent-sdk#4504
• Sandbox Server: feat: add stored MCP preflight probe sandbox-server#6
• Extensions: test: cover automation preflight requirements extensions#476