fix(security): harden external sinks and callbacks

[bokelley]

Summary

• validate and canonicalize A2A callback destinations with a fail-closed policy
• make the SQLAlchemy push-notification store tenant-scoped and compatible with a2a-sdk 1.0
• add a reusable production callback-security helper
• contain audit-sink failures and harden external property-list handling

Why

External callback and sink boundaries could accept unsafe destinations, cross tenant boundaries, or let downstream failures affect request processing.

Validation

• 122 focused A2A, callback-security, audit-sink, and property-list tests passed
• independent security review against current origin/main

Compatibility

The default callback policy is fail closed. Deployments that need dynamic destinations or DNS pinning must supply a custom sender and enforce resolution at connection time.

[aao-ipr-bot]

⚠️ Argus review could not complete

The automated review encountered an issue (possibly reached max turns, timed out, or failed to post the final gh pr review). A human reviewer should take this PR.

View workflow run

_{This is an automated message from the Argus AI review workflow.}