[AI-303] google_adk_agents: graph workflows, dynamic workflows, and durable HITL (ADK v2)

[DABH]

Draft PR body update for #1675

The current body is stale after merging main (activity_tool → activity_as_tool rename)
and after de-gating the random provider + pinning google-adk to upstream main.
Suggested replacement body below the line.

---

What was changed

Adds ADK Python v2 feature support to temporalio.contrib.google_adk_agents (JIRA AI-303: graph workflows, dynamic workflows, and human-in-the-loop):

• activity_node(activity_def, *, name=None, rerun_on_resume=False, **activity_config) (in .workflow, sibling of activity_as_tool) — wraps a Temporal activity as an ADK FunctionNode for use in Workflow(edges=[...]) graphs and dynamic ctx.run_node(...) calls. Single-param activities receive the upstream node's output directly; multi-param activities bind by name from a dict; local ADK runs call the function directly.
• Durable HITL helpers (exported from the package): HitlRequest, pending_hitl_requests(event), hitl_input_response(...), hitl_confirmation_response(...) — cover ADK's pause/resume wire format (adk_request_input / adk_request_confirmation function calls answered by FunctionResponses) so a workflow can expose pending requests via a query, wait durably on a signal/update, and resume the runner. Tool confirmation composes with activity_as_tool: FunctionTool(func=activity_as_tool(fn, ...), require_confirmation=True) never schedules the activity until a human approves.
• Fix: ADK platform providers were never active inside workflows. ADK holds its time/uuid providers in ContextVars; workflow code runs on executor threads whose contexts never saw the plugin's set_*_provider calls, so generated ids were stdlib uuid4 and Event timestamps wall-clock all along (masked because replay compares command sequences, not payloads — HITL makes it fatal since resume matches recorded responses by generated id). setup_deterministic_runtime() now installs the time, uuid, and random providers as ContextVar defaults, unconditionally. With the ids and retry jitter routed through google.adk.platform (see below), default RequestInput interrupt ids, _ToolNode function-call ids, and node-retry jitter all derive from workflow.uuid4() / workflow.random() and replay deterministically — no explicit interrupt_id plumbing required.
• google-adk floor → >=2.5.0,<3 (Workflow-as-Tool needs ≥2.4; standalone-node/NodeTool HITL resumption and resumable-mode hardening need 2.5).
• Temporary dev pin to ADK main: the seams the provider fix relies on merged upstream after 2.7.1 shipped, so [tool.uv.sources] pins google-adk to google/adk-python@8f85107c (lockfile-only; published metadata keeps the normal version range). Remove the pin and bump the floor once the first ADK release containing that commit ships.
• README sections: graph workflows, dynamic workflows, Workflow-as-Tool, durable HITL pattern, determinism notes. CHANGELOG entry under Unreleased.

Upstream dependencies (merged)

Two adk-python PRs route the remaining seam-bypassing call sites through google.adk.platform; both are now on ADK main and included in the pinned rev:

• fix: route workflow IDs and retry jitter through platform seams google/adk-python#6468 (merged as google/adk-python@8f85107c) — RequestInput.interrupt_id, _ToolNode.function_call_id, retry jitter (adds the platform random seam)
• fix: surface a deterministic exception from ParallelWorker on concurrent failures google/adk-python#6469 (merged as google/adk-python@d31b5e7d) — deterministic exception selection in _ParallelWorker

Neither is in a PyPI release yet (2.7.0/2.7.1 predate them), hence the [tool.uv.sources] git pin. There is no version-gated code: the plugin installs all three providers unconditionally, and the previously seam-gated tests now run unconditionally.

Why

ADK v2 (2.0–2.5) rebuilt the framework around a graph runtime; the integration predates it. The graph engine is pure-asyncio and session-event-driven, so it runs deterministically inside workflows with the existing activity seams (TemporalModel, MCP, activity_as_tool) intercepting unchanged — this PR adds the node-level helper, the HITL mapping, tests proving replay safety, and the provider fix that HITL surfaced.

Checklist

1. Closes AI-303 (graph + dynamic workflows + HITL; ToolContext/AI-163 landed separately in [AI-163] google_adk_agents: support ToolContext session state in activity_tool #1683)
2. How was this tested: 18 new integration test cases in tests/contrib/google_adk_agents/ (graph sequential/routing/parallel-join/multi-param/agent-node/timeout/retry/jittered-retry-replay; dynamic loop/gather/Workflow-as-Tool/resume-with-exactly-once-activity; HITL input-node resume via update, confirmation approve/reject with activity-execution counting, multi-pending partial responses, default-interrupt-id replay safety) — all workers run with max_cached_workflows=0 so every workflow task fully replays; jittered-retry and default-interrupt-id tests also re-verified via repeated runs; 2 new recorded replay histories (which replay green against the pinned ADK main, i.e. no history re-recording needed). Full tests/contrib/google_adk_agents suite against ADK main: 59 passed, 5 skipped (pre-existing: missing GOOGLE_API_KEY / MCP tests marked skip in CI). poe lint (ruff, pyright, mypy, basedpyright, pydocstyle) clean.
3. Any docs updates needed: contrib README updated in this PR.