Address maintainer feedback by standardizing HITL (Human-in-the-Loop)
functionality in kagent-core to enable uniform interrupt handling across
all executor types (LangGraph, CrewAI, ADK).

Changes:
- Add kagent-core/a2a/_hitl.py with framework-agnostic HITL types and utilities
- Add HITL constants to kagent-core/a2a/_consts.py
- Refactor kagent-langgraph executor to use core HITL utilities
- Extract backtick escaping to dedicated function
- Implement two-tier decision detection (DataPart priority, TextPart fallback)
- Change security default from approve to deny
- Fix: Use JSON for checkpoint metadata serialization (LangGraph 1.0 compatibility)
- Add 10 comprehensive tests for HITL functionality

Addresses: kagent-dev#1025 (comments kagent-dev#2, kagent-dev#4, kagent-dev#5, kagent-dev#6, kagent-dev#8)
Signed-off-by: apexlnc <43242113+apexlnc@users.noreply.github.com>

Implements all 16 review comments from inFocus7's code review to improve
code quality, test consistency, and validation reliability for the TLS
configuration feature.

Changes:

1. Fix CEL validation syntax (comment kagent-dev#16 - CRITICAL)
   - Replace != "" with size(field) > 0 for non-empty checks
   - Replace == "" with size(field) == 0 for empty checks
   - Fixes validation syntax errors that blocked CRD deployment

2. Remove task tracking comments (comments #1, kagent-dev#13, kagent-dev#14, kagent-dev#15)
   - Remove "(Task X.Y)" references from test docstrings
   - Remove obsolete implementation notes about env vars vs agent config
   - Remove test_openai_client_tls_parameters_override_environment (obsolete)

3. Fix copyright headers (comment #3)
   - Replace incorrect "Google LLC" copyright with Kagent project copyright
   - Apply consistent headers across test_ssl.py, test_tls_e2e.py, test_tls_integration.py

4. Migrate Go tests to testify (comments kagent-dev#5, kagent-dev#6)
   - Add testify/assert and testify/require imports
   - Replace manual error checks with testify assertions
   - Add envVarToMapHelper() for O(n) environment variable validation

5. Add golden tests for TLS scenarios (comment kagent-dev#12)
   - Create tls-with-custom-ca.yaml input
   - Create tls-with-disabled-verify.yaml input
   - Create tls-with-system-cas-disabled.yaml input
   - Generate golden outputs to catch TLS mounting regressions

6. Improve Python test quality (comments #2, kagent-dev#4, kagent-dev#9)
   - Remove redundant test case from test_ssl.py
   - Add test_e2e_openai_client_fails_without_custom_ca (negative test)
   - Simplify E2E_TEST_SUMMARY.md (72% reduction, remove task references)

7. Use OpenAI SDK's DefaultAsyncHttpxClient (comments kagent-dev#7, kagent-dev#8)
   - Replace custom httpx.AsyncClient with DefaultAsyncHttpxClient
   - Preserves OpenAI SDK defaults for timeout, pooling, and redirects
   - Add tests to verify SDK defaults are maintained

8. Fix documentation links (comment kagent-dev#10)
   - Update broken troubleshooting links to https://kagent.dev/docs

9. Document future enhancement (comment kagent-dev#11)
   - Created GitHub issue kagent-dev#1091 for automatic agent redeployment on secret changes

Test results:
- All Go tests pass (11 golden tests including 3 new TLS scenarios)
- All Python tests pass (15 tests including 2 new tests)
- CRD validation working correctly with proper error messages

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Implements all 16 review comments from inFocus7's code review to improve
code quality, test consistency, and validation reliability for the TLS
configuration feature.

Changes:

1. Fix CEL validation syntax (comment kagent-dev#16 - CRITICAL)
   - Replace != "" with size(field) > 0 for non-empty checks
   - Replace == "" with size(field) == 0 for empty checks
   - Fixes validation syntax errors that blocked CRD deployment

2. Remove task tracking comments (comments #1, kagent-dev#13, kagent-dev#14, kagent-dev#15)
   - Remove "(Task X.Y)" references from test docstrings
   - Remove obsolete implementation notes about env vars vs agent config
   - Remove test_openai_client_tls_parameters_override_environment (obsolete)

3. Fix copyright headers (comment #3)
   - Replace incorrect "Google LLC" copyright with Kagent project copyright
   - Apply consistent headers across test_ssl.py, test_tls_e2e.py, test_tls_integration.py

4. Migrate Go tests to testify (comments kagent-dev#5, kagent-dev#6)
   - Add testify/assert and testify/require imports
   - Replace manual error checks with testify assertions
   - Add envVarToMapHelper() for O(n) environment variable validation

5. Add golden tests for TLS scenarios (comment kagent-dev#12)
   - Create tls-with-custom-ca.yaml input
   - Create tls-with-disabled-verify.yaml input
   - Create tls-with-system-cas-disabled.yaml input
   - Generate golden outputs to catch TLS mounting regressions

6. Improve Python test quality (comments #2, kagent-dev#4, kagent-dev#9)
   - Remove redundant test case from test_ssl.py
   - Add test_e2e_openai_client_fails_without_custom_ca (negative test)
   - Simplify E2E_TEST_SUMMARY.md (72% reduction, remove task references)

7. Use OpenAI SDK's DefaultAsyncHttpxClient (comments kagent-dev#7, kagent-dev#8)
   - Replace custom httpx.AsyncClient with DefaultAsyncHttpxClient
   - Preserves OpenAI SDK defaults for timeout, pooling, and redirects
   - Add tests to verify SDK defaults are maintained

8. Fix documentation links (comment kagent-dev#10)
   - Update broken troubleshooting links to https://kagent.dev/docs

9. Document future enhancement (comment kagent-dev#11)
   - Created GitHub issue kagent-dev#1091 for automatic agent redeployment on secret changes

Test results:
- All Go tests pass (11 golden tests including 3 new TLS scenarios)
- All Python tests pass (15 tests including 2 new tests)
- CRD validation working correctly with proper error messages