[codex] fix MCP workflow tool calls

[mbakgun]

What changed

• JSON-RPC MCP tools/call now treats fileUploadTrigger workflows like the REST MCP tool path: it mints an upload slot and returns the upload payload instead of executing the workflow with empty trigger input.
• Legacy SSE tools/call requests now return 202 Accepted immediately and deliver the final JSON-RPC response through the SSE channel.
• Long-running MCP tool calls now emit periodic progress updates when the client provides _meta.progressToken; Streamable HTTP tool calls also stream SSE heartbeat comments so clients receive bytes while the workflow is running.
• Added backend coverage for default and named MCP servers, file upload JSON-RPC calls, legacy SSE progress, and Streamable HTTP progress/final responses.

Why

The JSON-RPC path skipped the existing file-upload special case and executed file upload workflows without uploaded file input, producing { "fileUpload": { "file": {}, "uploaded_at": null } }.

Long-running workflow calls also held the MCP POST open until completion, so clients with first-byte or idle timeouts could disconnect before Heym returned the tool result.

Validation

• SECRET_KEY=test-secret-key-for-tests-only-32-bytes uv run pytest tests/test_mcp_jsonrpc_tool_calls.py tests/test_mcp_servers.py tests/test_mcp_origin_mismatch.py
• SECRET_KEY=test-secret-key-for-tests-only-32-bytes ./check.sh