test(managed-agent): gate detach while a tool result is unknown (#16098)

The MCP detach must refuse before it releases anything when an
operation is recovery_blocked/outcome_unknown. Start an ext://hold
read, kill the stdio fixture, and call the Harness detach route; the
case requires the documented refusal, no release control, and the
operation still unknown.

The Hosted fork moves by the case's measured 27.4 s, booked at 55 s.

.github/workflows/sdk-java.yml

@@ -1097,7 +1097,7 @@ jobs:
     name: 'Hosted process fault gates / MySQL 8.4 / Java 21'
     if: "${{ inputs.tier != 'fast' }}"
     runs-on: 'ubuntu-latest'
-    # The step ceilings today (203 + 20 + 50 + 20 = 293 — the FG8 letters
+    # The step ceilings today (204 + 20 + 50 + 20 = 294 — the FG8 letters
     # grew the shared failsafe fork to 3600 s, FG9 slice 3 to 3990 s, the
     # FG10b–f workflow relay letters to 4484 s, the FG12a MCP reply-loss
     # letter to 4499 s, the FG12c restart matrix to 4548 s, the FG13c Hook
@@ -1174,18 +1174,21 @@ jobs:
     # margin (12104 s of fork plus wrap, 16 s left); the FG12d two-server
     # release cell adds 32 s (16.2 s measured), so the fork moves to 11536 s
     # and Verify to 203 minutes, wrapping fork + 600 s plus margin (12136 s
-    # of fork plus wrap, 44 s left);
+    # of fork plus wrap, 44 s left); the FG12d detach-unknown cell adds 55 s
+    # (27.4 s measured), so the fork moves to 11591 s and Verify to 204
+    # minutes, wrapping fork + 600 s plus margin (12191 s of fork plus wrap,
+    # 49 s left);
     # the Broker fault gates use 20,
     # and admission plus O4 keep per-fork ceilings) plus a 33-minute
     # allowance for the uncapped setup steps (Checkout.. cgroup delegation,
     # the report checks), which took under 10 minutes on every nightly from
-    # 10-14 to 10-30: 293 + 33. A Verify that timed out used to skip
+    # 10-14 to 10-30: 294 + 33. A Verify that timed out used to skip
     # admission, leaving that path 50 minutes spare; admission now runs
     # after it, so that path too can fill all four capped ceilings. The
     # allowance sits above the ~13-minute floor so that a slow setup (the
     # CLI install makes up to three attempts) still leaves the O4 gates
     # time to run. The failover arms run in hosted-failover-e2e.
-    timeout-minutes: 326
+    timeout-minutes: 327
     services:
       mysql:
         image: 'mysql:8.4.6'
@@ -1285,10 +1288,10 @@ jobs:
         # fork leaves no per-test failure lines, so the main-CI failure
         # analyzer can only file an undiagnosable per-commit issue (#13503).
         # hosted-process-ci.test.js pins this ordering; the fork budget is
-        # 11536 s, so the step wraps to fork + 600 s plus margin (203 min,
-        # 44 s left before the step must move), including the provisional
+        # 11591 s, so the step wraps to fork + 600 s plus margin (204 min,
+        # 49 s left before the step must move), including the provisional
         # 180 s pool-fixture reservation pending CI measurement.
-        timeout-minutes: 203
+        timeout-minutes: 204
         env:
           MAVEN_ARGS: '--settings ${{ runner.temp }}/setup-java-m2/settings.xml --toolchains ${{ runner.temp }}/setup-java-m2/toolchains.xml'
           MYSQL_PORT: "${{ job.services.mysql.ports['3306'] }}"