[Feature][Agent Gateway] Configure remote MCP payload budgets within hard bounds #8391

Feature Request

Allow trusted configuration to select bounded remote MCP request and response byte budgets. The current fixed 8 KiB transport limit prevents otherwise permitted tool/resource results from passing through a gateway rule with a larger response budget.

Current behavior and evidence

Reviewed against master 88883dc20fb1f57db6343ba811c1d1f3ee70a6bf.

• RequestScopedMcpClient fixes both MAX_REQUEST_BYTES and response LIMIT at 8192 bytes. Request serialization is checked against the former, and the HTTP body subscriber enforces the latter.
• AgentGatewayAggregationConfig accepts no per-server transport budget settings.
• The entry rule defaults are 256 KiB for requests and 1 MiB for responses, with their own hard maxima. Changing these entry settings does not change the remote transport budget.

For example, a valid 20 KiB JSON tool result is rejected by the remote adapter even when the matched entry rule allows 1 MiB. Large tool schemas can also exhaust the remote discovery response limit. This is an intentional current bound that needs a controlled configuration path, not a request to remove memory limits.

Proposed scope

• Introduce separate trusted remote request/response byte settings with explicit units, defaults and hard maxima. Preserve the current 8 KiB defaults for existing configurations unless a separately documented compatibility decision changes them.
• Validate shared configuration consistently before Admin persistence and when the gateway receives it, then capture the selected budgets in immutable remote bindings. Request metadata must not override them.
• Document which budgets cover initialization, directory discovery, tool calls and resource reads. Distinguish remote wire bytes from the inbound request and final rendered response budgets, including JSON/SSE framing and rewritten content.
• Enforce the remote bound during body receipt, before complete-body decoding; enforce any final entry bound after transformation as well. Include bounded allocation/serialization behavior and explicit treatment of unsupported or compressed encodings.
• Preserve cancellation, deadlines, credential isolation and the no-replay rule. Invalid updates must retain the established configuration rejection semantics.

Acceptance criteria

• With legacy configuration, the current 8 KiB behavior remains covered.
• With an explicitly larger supported budget, a controlled server's 20 KiB tool result and a corresponding resource result succeed when the final entry budget also permits them.
• Requests/responses immediately below, at and above each configured bound have deterministic outcomes; count UTF-8 bytes and transport envelopes correctly.
• Oversized chunked/SSE bodies stop receiving data and release owned resources without first buffering an unbounded response.
• Changing the entry budget alone cannot silently enlarge the remote budget; the effective limits and rejection layer are documented.
• Invalid values, configuration replacement and concurrent old/new calls cannot bypass maxima or mix binding snapshots.
• Concurrent large-response fixtures demonstrate bounded retained memory together with the admission policy.

Ownership and verification

This is a focused payload-budget follow-up to #7951, which owns aggregate admission, bounded queues and total resource isolation. Coordinate the configuration with its open PR #8095; do not create another admission controller. That PR currently describes configurable concurrency and queue limits, while this issue supplies the specific per-message byte-budget behavior and boundary acceptance.

Reuse #7952 for catalog lifecycle and #8196 for protocol profiles. DNS/connectivity remains #7953; server/tool/page count limits are outside this issue.

The finding is established from current source and documented limits. The baseline selected Agent Gateway suite passed 311 tests; no new large-payload network fixture was run for this issue.