feat(cli): add governed Google ADK Python and TypeScript adapters

[Baziar]

Thank you for contributing to Workspai

Please make sure:

• The related issue is linked (if applicable)
• Repository validation passes locally (npm run validate)
• Documentation validation passes for doc changes (npm --workspace workspai run validate:docs)
• Contract validation passes for contract changes (npm --workspace workspai run contracts:validate)
• Documentation was updated when behavior changed
• Changes are focused and backward-compatible

What changed

• Added governed Google ADK adapters and preview project kits for Python and TypeScript, with pinned SDK baselines, bounded Workspai context tools, provider validation, session continuity, timeouts, and credential-safe defaults.
• Implemented streaming using the official ADK partial and final-response semantics. Partial fragments are emitted exactly as yielded, intermediate metadata preserves the fragment window, tool events create explicit boundaries, and final aggregates are not re-emitted.
• Disabled OpenTelemetry by default before importing ADK. Credentialless conformance verifies a non-recording span without opt-in and a recording span in a separate process started with WORKSPAI_AGENT_TRACING=1.
• Kept Create fail-closed for adapters absent from release-admissions.v2.json, including before --dry-run or filesystem mutation. Preview kits are labeled awaiting release admission.
• Moved shared context loaders into agent-frameworks/context-loaders/, expanded Create/Doctor/planner workflow coverage, and added Linux conformance evidence without promoting Google ADK into the release admission inventory.
• Compared GitHub API mock URLs by hostname instead of substring matching so CodeQL no longer flags the version-policy tests.

Why this change

Workspai needs first-class Google ADK support without bypassing its ownership, mutation, security, and release-admission boundaries. These adapters provide usable Python and TypeScript starters while keeping unpublished kits unavailable through Create until the full qualification matrix has been reviewed.

The streaming implementation also removes text-prefix heuristics that corrupted repeated or prefix-shaped fragments. Both runtimes now follow the SDK’s official event semantics.

Validation

• corepack npm run typecheck — passed
• Targeted Vitest suites — 15/15 passed
• Generated Python tests — 13 passed
• Generated TypeScript tests — 12/12 passed
• Python Linux conformance — 18/18 passed
  • google-adk 2.9.2
  • CPython 3.10.21
• TypeScript Linux conformance — 18/18 passed
  • @google/adk 2.1.0
  • Node 24.20.0
• Streaming and telemetry markers observed:
  • WORKSPAI_AGENT_STREAMING_OK
  • WORKSPAI_AGENT_TELEMETRY_OK
• Prettier check — passed
• git diff --check — passed

Full qualification still requires Python and TypeScript conformance on Linux, macOS, and Windows for the same commit. release-admissions.v2.json remains unchanged.

Checklist (maintainer-friendly)

• No unrelated refactors
• No sensitive data introduced
• Release notes/changelog updated