fix(studio): preserve managed agent capabilities when reopening

[zakahan]

Opening the same managed agent Session twice previously replaced its page capability, so the first tab or in-flight DeepSeek Harness assets (including deepseek-harness-auth-query.js) received HTTP 403. Reuse the unexpired capability for the same owner and Session, reading it after the awaited cloud lookup so concurrent opens also converge on one capability.

Each open still validates cloud Session readiness and ownership, refreshes the cached endpoint, and preserves the original capability expiry. Expired capabilities rotate; deleting a Session revokes access. This shared service also serves OpenClaw and Hermes.

Validation:

• Added regressions reproduced the asset 403 and concurrent capability replacement before the fix.
• pytest tests/cli/test_frontend_sandbox.py tests/cli/test_frontend_agent_proxy.py -q: 126 passed.
• Pre-commit on both changed files: Ruff lint/format and Gitleaks passed.
• Coverage includes old-tab asset requests, concurrent opens for all three agent kinds, owner/admin isolation, credential refresh, unchanged TTL, expired/invalid capabilities, Session readiness, and deletion.

Draft limitations: this fixes a locally reproduced cause consistent with the reported 30-byte 403; the deployed response body and version have not been verified. Capabilities remain process-local, so cross-instance routing and process restarts still require separate work. Stable resource URLs avoid needless URL churn on reopen, but production loading latency has not been measured or claimed resolved.