Add Orbit agent command surface

@dgruzd This MR adds the GitLab Rails side of the Orbit agent command surface described in gitlab-org/orbit/knowledge-graph!1253 (merged).

It keeps the existing Orbit tools additive during rollout, adds command-wrapper discovery behind orbit_mcp_command_tools, exposes REST endpoints for command consumers, including schema/dsl and schema/format convenience endpoints, and routes Rails-owned commands through the existing Rails execution paths.

Relates to:

• gitlab-org/orbit/knowledge-graph#553 (closed)
• gitlab-org/orbit/knowledge-graph#577

Depends on:

• gitlab-org/orbit/knowledge-graph!1252 (merged)
• gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!5446 (merged)

Flow

flowchart LR
  Agent[Orbit agent] -->|MCP: list_commands| DWS[Duo Workflow Service]
  DWS --> Rails[Rails MCP + REST]
  Rails -->|ListAgentCommands| GKG[GKG command registry v2]
  GKG -->|names, descriptions, schemas, source_type| Rails
  Rails -->|TOON command catalog| Agent

  Agent -->|MCP: invoke_command| DWS
  Rails -->|GKG-owned commands| Invoke[GKG InvokeAgentCommand]
  Invoke -->|DSL, schema, response format context| Agent
  Rails -->|Rails-owned query_graph| Interceptor[Command interceptor]
  Interceptor --> Stream[existing Workhorse query_graph stream]
  Stream --> Agent

  Rest[REST client] -->|GET /orbit/agent/commands| Rails
  Rest -->|POST /orbit/agent/commands/:name| Rails
  Rest -->|GET /orbit/schema/dsl| Rails
  Rest -->|GET /orbit/schema/format| Rails

Rails changes

• Adds GET /orbit/agent/commands and POST /orbit/agent/commands/:name.
• Adds GET /orbit/schema/dsl and GET /orbit/schema/format for REST DSL and response-format discovery.
• Adds list_commands and invoke_command to MCP tool discovery when orbit_mcp_command_tools is enabled.
• Keeps the legacy Orbit MCP tools working while the feature flag is disabled.
• Trusts and pre-approves the command wrapper tools for Duo Workflow Service, matching the legacy Orbit tools.
• Adds a command interceptor so query_graph continues through the existing Workhorse streaming path.
• Leaves get_graph_status on the legacy direct surface and keeps it out of the new command list.
• Does not add get_graph_info.
• Updates granular token docs for the new REST endpoints.