[PLT-3225] feat: add protected API authorization outcome

[TheMostlyGreat]

Why

Companion to ArcadeAI/monorepo#3731. Enterprise token exchange needs a private, execution-boundary contract for giving a trusted customer-managed Worker the exchanged target token and returning a fixed protected-API outcome without exposing credential material in public tool data.

What

• Adds a one-attempt protected API adapter.
• Adds the protected_api tool capability declaration.
• Carries the private authorization outcome through HTTP and MCP Worker transports.
• Keeps the outcome contract fixed to status, reason, and request-count evidence.
• Versions the coordinated core, TDK, serve, and MCP server packages.

Verification

The coordinated branch test run completed with 3,745 tests passed and one skipped; changed-package formatting and type checks passed.

Review ask

@wdawson, please review this together with ArcadeAI/monorepo#3731, especially the credential boundary and the decision to keep the target token in the existing private authorization context.

[codecov]

Codecov Report

❌ Patch coverage is 89.65517% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
libs/arcade-core/arcade_core/protected_api.py	83.67%	8 Missing ⚠️
libs/arcade-core/arcade_core/executor.py	83.33%	1 Missing ⚠️

Files with missing lines	Coverage Δ
libs/arcade-core/arcade_core/schema.py	98.78% <100.00%> (+0.05%)	⬆️
.../arcade-mcp-server/arcade_mcp_server/decorators.py	100.00% <ø> (ø)
libs/arcade-mcp-server/arcade_mcp_server/server.py	86.12% <100.00%> (+0.20%)	⬆️
libs/arcade-serve/arcade_serve/core/base.py	96.55% <100.00%> (+0.04%)	⬆️
libs/arcade-tdk/arcade_tdk/protected_api.py	100.00% <100.00%> (ø)
libs/arcade-tdk/arcade_tdk/tool.py	92.13% <100.00%> (+0.56%)	⬆️
libs/arcade-core/arcade_core/executor.py	97.91% <83.33%> (+0.13%)	⬆️
libs/arcade-core/arcade_core/protected_api.py	83.67% <83.67%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[wdawson]

Thanks for the prototype. Will definitely take a look as we get closer to building

[TheMostlyGreat]

Reopening as a draft now that the companion Gateway implementation has stabilized. Fresh validation on current main: 3,745 tests passed, 1 skipped; pre-commit passed; strict mypy passed for all four changed libraries (arcade-core, arcade-tdk, arcade-serve, and arcade-mcp-server). The companion monorepo work now keeps the Intermediate AS as the Gateway trust boundary and publishes per-Engine managed JWKS for rotation. The only local umbrella-check failure is an unrelated existing NumPy-stub/Python-target mismatch in untouched CLI/evals packages. @wdawson, please take another look when ready; this remains draft pending coordinated review.

[github-actions]

This pull request has been automatically marked as stale because it has had no activity for 14 days. It will be closed in 14 days if no further activity occurs. If this is still relevant, please leave a comment or remove the stale label.