fix(app-studio): MCP discovery honors KEDGE_HUB_INSECURE

app-studio reaches the hub's MCPServer virtual-workspace endpoint at the
in-cluster service DNS (kedge-...-hub.<ns>.svc.cluster.local:9443), but the
hub serves its external cert (e.g. console-dev.faros.sh) with no SAN for the
internal name. Every provider — and app-studio's own GraphQL client and
heartbeat — skips verification for in-cluster hub calls via KEDGE_HUB_INSECURE.

The MCP path, however, was gated by a separate APP_STUDIO_MCP_INSECURE_SKIP_TLS_VERIFY
flag that the Helm chart never templates, so there was no way to make MCP
discovery trust the hub even when the operator set hub.insecure. Result:
GraphQL worked, MCP tool discovery failed with
"x509: certificate is valid for console-dev.faros.sh, not kedge-...-hub.svc.cluster.local".

Make the MCP TLS-skip honor KEDGE_HUB_INSECURE in addition to its own flag,
matching the other hub clients. No chart/value changes needed: prod already
sets KEDGE_HUB_INSECURE=true.

Also pick up the license boilerplate codegen added to the new
install/apiexport_test.go.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mjudeikis

providers/app-studio/main.go

@@ -162,7 +162,13 @@ func runServe() {
 		msgStore,
 		openWorkspaceStore(),
 		os.Getenv("KEDGE_HUB_URL"),
-		os.Getenv("APP_STUDIO_MCP_INSECURE_SKIP_TLS_VERIFY") == "true",
+		// The MCP virtual-workspace endpoint lives on the same hub host as the
+		// GraphQL client above, so it must honor the standard KEDGE_HUB_INSECURE
+		// knob every provider uses for in-cluster hub TLS (the hub serves its
+		// external cert, not one valid for the .svc.cluster.local name). Keep the
+		// MCP-specific override too, for callers that want to scope it narrowly.
+		os.Getenv("APP_STUDIO_MCP_INSECURE_SKIP_TLS_VERIFY") == "true" ||
+			os.Getenv("KEDGE_HUB_INSECURE") == "true",
 	)
 	apiServer.SetAutoApproveAssistantActions(os.Getenv("APP_STUDIO_AUTO_APPROVE_ACTIONS") == "true")
 	if secret := os.Getenv("APP_STUDIO_PREVIEW_TOKEN_SECRET"); secret != "" {

providers/infrastructure/install/apiexport_test.go

@@ -1,3 +1,19 @@
+/*
+Copyright 2026 The Faros Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 package install
 
 import (