Summary

• Bind HITL confirmation resume to prior ADK-generated function-call state before executing resumed tool calls.
• Add a stable FunctionCall digest to tool-auth request events and verify it before auth_preprocessor resumes the original call.
• Reject resume targets that cannot be tied back to prior requested_tool_confirmations / requested_auth_configs metadata.

Context

Related to #5290/#5291. Those changes harden session-initialization/runtime event spoofing around HITL. This PR also covers persisted event tampering during resume and the sibling auth-resume path, where resumed tool calls were reconstructed from session event content without verifying that the tool name/args still matched prior ADK state.

Validation

• .venv\Scripts\python.exe -m pyink --check <touched files>
• .venv\Scripts\python.exe -m pytest tests\unittests\flows\llm_flows\test_request_confirmation.py tests\unittests\auth\test_auth_preprocessor.py tests\unittests\runners\test_run_tool_confirmation.py tests\unittests\auth\test_toolset_auth.py -q (41 passed)
• .venv\Scripts\python.exe -m pytest tests\unittests\auth tests\unittests\flows\llm_flows -q (562 passed)
• Re-ran a local HITL event-tampering PoC against the patched checkout: the bypass did not reproduce and no resumed tool call executed.