`A2uiMessage.fromJson` accepts objects carrying more than one of `createSurface`/`updateComponents`/`updateDataModel`/`deleteSurface`

_↴ Ported from [flutter/genui#934](https://github.com/flutter/genui/issues/934) — originally opened by [andrewkolos](https://github.com/andrewkolos) on 2026-05-26._
_Original labels: front-line-handled_
_Original assignees: [andrewkolos](https://github.com/andrewkolos)_

---

[`A2uiMessage.fromJson`](https://github.com/flutter/genui/blob/ae53cc52b35b72312f01b80eeb565163e3c869d7/packages/genui/lib/src/model/a2ui_message.dart#L20). The message type is parsed in the order of 1) `createSurface`, 2) `updateComponents`, 3) `updateDataModel`, and then 4) `deleteSurface`). The function returns on the first match.

A payload that matches multiple of these checks will silently parse as whatever happens to come first instead of failing validation.

```dart
final message = A2uiMessage.fromJson({
'version': 'v0.9',
'createSurface': {'surfaceId': 's1', 'catalogId': 'c1'},
'updateComponents': {'surfaceId': 's1', 'components': []},
});
// Expected: A2uiValidationException
// Actual: parses as CreateSurface, drops updateComponents silently
```

I would normally consider this a corner case and not bother with fixing it, as I think an LLM is very unlikely to generate a message that matches multiple types. However, 1) I'd like `package:genui` to have as much parity with other renderers as possible ([`web_core` does include logic to catch this case](https://github.com/google/A2UI/blob/0e0375749bf8a940d57969d612e74f7221ad246e/renderers/web_core/src/v0_9/processing/message-processor.ts#L229-L262)) and 2) the 0.9 spec does explicitly specify `oneOf` and `additionalProperties: false` for each message type, so fixing this would also make the genui package follow the spec more closely.

Das Issue befindet sich im Dart-Paket `genui`, in der Datei `packages/genui/lib/src/model/a2ui_message.dart`. Sieh dir die Methode `A2uiMessage.fromJson` und ihre Parsing-Reihenfolge an. Vergleiche sie mit der Validierungslogik im web_core-Renderer (`renderers/web_core/src/v0_9/processing/message-processor.ts`, Zeilen 229–262). Die Korrektur sollte sicherstellen, dass die JSON-Nutzlast genau eines der angegebenen Nachrichtenfelder enthält, und bei mehreren Treffern eine `A2uiValidationException` auslösen. Schreibe einen Test für den ungültigen Fall.

Vom Indexierungsmodell aus dem Issue-Text verfasst.