feat: per-run toolkit cloning for multi-user credential isolation

[Mustafa-Esoofally]

Summary

Adds _clone_for_run() to the Toolkit base class for per-user credential isolation in multi-tenant deployments (Slack, Telegram, WhatsApp via AgentOS).

Problem: When multiple users send concurrent requests via Slack, all requests share the same toolkit instance. The @google_authenticate decorator stores self.creds and self.service on the shared instance — if User A authenticates first, User B's request reuses A's credentials.

Solution: parse_tools() shallow-copies each Toolkit via _clone_for_run() when user_id is set, so each run gets its own mutable state. The existing auth decorator and all 74 Google tool methods remain unchanged.

Changes

• toolkit.py — _clone_for_run(): copy.copy(self) + reset creds, service, and any *_service attributes to None
• _tools.py — Clone in parse_tools() when user_id is set + rebind Function entrypoints to the clone
• auth.py — authenticate_google defaults to all registered services (one OAuth for everything), get_oauth_router accepts db param
• Formatting — import sort order fixes in Google toolkit files (ruff)
• Tests — 14 new tests covering clone isolation, entrypoint rebinding, multi-user scenarios

Design Decisions

• Clone vs ContextVar: Clone isolates ALL mutable state automatically (creds, service, label_cache, user_email, slides/drive services). ContextVar would require manually wrapping each attribute in properties — miss one and credentials leak silently.
• Clone vs per-method _get_service(run_context): Clone requires zero changes to 74 tool methods. The alternative touches every method signature.
• Entrypoint rebinding: Uses registered tool name (not __name__) to handle custom-named and @tool-decorated methods correctly.
• *_service reset loop: Catches Slides' slides_service/drive_service without hardcoding — any future toolkit with *_service attributes gets reset automatically.

Verification

• Unit tests: 14 clone tests + 47 existing toolkit tests (61 total, all pass)
• E2E Slack test: PAL Local bot → OAuth flow → token stored in DB → Gmail API call with per-user creds
• Concurrent isolation test: 3 simultaneous arun() calls with different user_ids — mustafa gets emails, alice/bob correctly blocked, original toolkit stays clean

Type of change

• New feature (non-breaking change which adds functionality)

Checklist

• Format and validate: ./scripts/format.sh && ./scripts/validate.sh
• Both sync and async paths covered (parse_tools handles both)
• Backward compatible — no clone when user_id is None (single-user unchanged)
• No changes to existing tool method signatures

[github-actions]

This pull request has been automatically marked as stale due to 14 days of inactivity. If this is still relevant, please update it or leave a comment.

[Mustafa-Esoofally]

Consolidated into #7635 together with PR #7376 (DB-backed OAuth). The single unique commit from this branch (f2c1d0ba8 — Toolkit._clone_for_run() + auto-clone hook in parse_tools + test_clone_for_run.py with 14 tests) cherry-picked onto #7635 as b835f0b69.

#7635 also adds test_google_auth_concurrent.py which exercises the cloning + DB-auth flow end-to-end under real-thread concurrency (16 workers × 48 calls with forced 10ms interleave).

Happy to close this in favor of #7635 once reviewers confirm the consolidation preserves the isolation semantics.

[Mustafa-Esoofally]

Consolidated into #7635 together with #7376. The single unique commit (f2c1d0b — Toolkit._clone_for_run + auto-clone hook in parse_tools + test_clone_for_run.py with 14 tests) was cherry-picked onto #7635 as 0a7def3.

#7635 also adds test_google_auth_concurrent.py which exercises the cloning + DB-auth flow end-to-end using real google.oauth2.credentials.Credentials + real-thread interleaving (16 workers × 48 calls with forced 10ms yield).

Review thread is continued on #7635.