Kill ENABLE_MANAGED_AGENT_CONFIG; gate managed config on the server SAFE flag (#504)

## 🥞 Stack (ug configure + managed-config)

- #500
  - **#504** ⬅ this PR
    - #510

---

## What did you change, and why?

Removes the client-side `ENABLE_MANAGED_AGENT_CONFIG` opt-in (a bug-bash
flag) and `managed_agent_config_enabled()`. Per team decision,
workspace-managed coding-agent config is now gated purely by the
server-side SAFE flag, which surfaces as a `FEATURE_DISABLED` reason
from `refresh_managed_config` (made authoritative in #500).

Two constraints had to keep holding, and do:
- Feature disabled server-side means admins and users see nothing about
managed config.
- omnigent's `ucode configure --profiles DEFAULT --agents
claude,codex,pi --use-pat --skip-validate --skip-upgrade` stays fully
non-interactive.

Where to look:
- `cli.py` is the bulk of the diff: deletes the env-var gates, drops the
`ug configure` admin auto-routing (it was a passthrough when the flag
was unset, so `ug configure` now behaves for everyone as it did for
non-flag users), and removes `--skip-managed-config` (it worked by
unsetting the now-gone env var). `status` and the launch "no managed
config" note now key off the server signal.
- Bare `ug` on a feature-disabled workspace prints one managed-free
guidance line (run `ug configure`, then `ug <agent>`) instead of a
silent no-op.
- Launch always fetches and applies the managed config: the
cached-launch fast path is gone, so stale local state cannot bypass an
admin's config. Correctness over the small per-launch latency.

## How do you know it works?

Unit suites (test_cli, test_managed_config, test_managed_wizard,
test_lint) green; ruff check and format clean. PR CI green (test + e2e).
A prior gpt-6-astra review verified both hard constraints; its one
finding (feature-disabled help still surfaced managed-config wording) is
addressed by the managed-free guidance line.

## Follow-up (not in this PR)

`ug status` reads the managed-config cache directly
(`load_managed_state`), with no server-state check, so in a server-side
enabled to disabled transition it can surface a stale managed summary
until the next `ug configure` or launch clears the cache. Dormant today
(the feature is unramped, so the cache is empty everywhere) and
self-healing on the next refresh. Deferred: closing it means making
`status` refresh from the server, which trades its offline-cheap
local-diagnostic nature. Will address before the feature ramps.

This pull request and its description were written by Isaac.

Co-authored-by: Isaac <no-reply@databricks.com>

Author: david-siqi-liu