Add Orbit foundational chat agent

What does this MR do and why?

Adds the Orbit foundational chat agent, gated behind a new :orbit_foundational_agent feature flag. With the flag on, "Orbit" shows up in the Duo Chat agent picker and the workflow gets Orbit's Knowledge Graph MCP tools injected at runtime.

Two independent feature flags control the rollout:

• :orbit_foundational_agent (new): Whether the agent appears in the picker
• :knowledge_graph (existing): Whether MCP tools get injected and the backend API is reachable

Carved out from !230181. The parent MR bundles the dashboard redesign, the Workhorse routing and the agent registration. This MR extracts just the last piece so it can ship on its own flag.

References

• Parent MR: !230181 (Overhaul Orbit dashboard with agent-first design)
• Feature flag rollout issue: #597629

How to set up and validate locally

1. Enable the flag in the Rails console:

   Feature.enable(:orbit_foundational_agent)

2. Open GraphiQL at http://127.0.0.1:3000/-/graphql-explorer and run:

   {
     aiFoundationalChatAgents {
       nodes { id name reference version }
     }
   }

3. Confirm orbit_agent is in the returned nodes (id: "gid://gitlab/Ai::FoundationalChatAgent/orbit_agent-v1", name: "Orbit").

4. Disable the flag (Feature.disable(:orbit_foundational_agent)) and re-run the query. orbit_agent should be gone, leaving the other six agents intact.

5. To also check the MCP wiring, enable :knowledge_graph and verify in the Rails console:

   Ai::DuoWorkflows::McpConfigService
     .new(User.find_by(username: 'root'), 'fake-token', workflow_definition: 'orbit_agent/v1')
     .execute
     .keys
   # => should include :orbit

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.