Python: preserve mixed-pause recovery invariants - #8518

Motivation & Context

A mixed batch containing approval-required and Host-owned calls can finish local execution before the provider accepts the result-delivery request. If that request is invalidated, clearing the completed batch immediately loses the only replayable copy even though the approved local tool has already run.

PR #8449 bounded stateless pause-response ownership to user turns and rejected direct conflicting occurrence-identified Host results. This change builds on that merged work and closes the remaining #8436 gaps: stateful identified/id-less correlation, handling of extra Host replays, and recovery when provider result delivery is invalidated.

Description & Review Guide

• What are the major changes?

  • Keep a serializable provider outbox until result delivery succeeds, then clear it.
  • Replay stored Host and local results without re-authorizing or re-executing approved tools.
  • Preserve charged invocation budgets across invalidation and session serialization, including cross-process duration rebasing and fail-closed validation of malformed state.
  • Match occurrence-identified Host results before id-less compatibility results when a call_id is reused.
  • Deduplicate equivalent extra Host replays only when they can be attributed to active Host occurrences, and reject conflicting extra responses before provider delivery.
  • Preserve provider continuation rollback for framework-created, non-authoritative sessions without granting them approval authority.
  • Update the function-calling specification, provider-invalidation decision record, core contributor guidance, and regression coverage.

• What is the impact of these changes?

  • Approved local tool results are replayed after provider invalidation without re-running the tool.
  • Streaming and non-streaming paths use the same serializable outbox recovery flow.
  • Reused call_id batches no longer remain pending or forward contradictory/orphaned Host results.
  • Completed historical stateless batches remain inert under later identifier reuse.
  • No public API signatures change.

• What do you want reviewers to focus on?

  • The outbox lifecycle: persist before provider delivery, retain on invalidation, and clear only after success.
  • The boundary between authoritative approval state and continuation cleanup.
  • How id-less Host replays are deduplicated without consuming an approval result.
  • The serialized duration-budget validation and fail-closed behavior.

Related Issue

Fixes #8436

Built on #8449, which has already been merged.

Validation

Run from python/:

• uv run pytest packages/core/tests -q
• uv run pytest packages/ag-ui/tests -q (1367 passed, 14 skipped)
• uv run pytest packages/declarative/tests -q
• uv run pytest packages/foundry_hosting/tests -q
• uv run ruff check packages/core/agent_framework/_tools.py packages/core/tests/core/test_function_invocation_logic.py
• uv run ruff format --check packages/core/agent_framework/_tools.py packages/core/tests/core/test_function_invocation_logic.py
• uv run pyright packages/openai packages/core/agent_framework packages/core/tests/core/test_function_invocation_logic.py (0 errors, 0 warnings)
• git diff --check

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.