[BUG] agentscope-runtime A2A context ID selects runtime session, default user, interrupt, and sandbox state

## Summary

agentscope-runtime promotes inbound A2A `context_id` into runtime `session_id`, then defaults `user_id` from that same session key when no stronger principal is present. In the replay, Alice and Bob using the same A2A context collide on runtime session, default user, interrupt key, and sandbox environment; Bob reads Alice sandbox secret. Fresh-context and principal-bound controls isolate correctly.

## Affected Target Verified

- Repository: `https://github.com/agentscope-ai/agentscope-runtime`
- Component: A2A adapter, runner, interrupt, and sandbox service
- Affected commit verified: `22072fd7075c`
- Vulnerability type: Context/session and sandbox authority rebinding

## Preconditions

- A shared A2A runtime accepts requests from multiple callers.
- No stronger principal is supplied to the runtime.
- Callers can choose or reuse A2A `context_id`.

## Steps To Reproduce

From the attachment directory:

```bash
bash reproduce.sh
```

The script clones the target repository, checks out the verified commit, prepares a local test environment, and runs the bundled PoC. It does not contact attacker-controlled services; the setup only downloads the public repository and normal build dependencies.

To run against an existing checkout:

```bash
AGENTSCOPE_RUNTIME_TARGET_DIR=/path/to/checkout bash reproduce.sh
```

The wrapper accepts `AGENTSCOPE_RUNTIME_TARGET_DIR` for an existing checkout. It also accepts the target commit override documented in `attachments/reproduce.sh`.

## Technical Details

The A2A adapter maps `context_id` to runtime `session_id`; the runner defaults user identity from session id; interrupt and sandbox keys derive from those values.

## Expected Behavior

A2A `context_id` should be treated as caller-controlled correlation metadata.
Runtime session, default user, interrupt, and sandbox keys should include a
trusted caller or tenant dimension, or use server-generated opaque state, before
sharing state between requests.

## Actual Behavior

- Same-context callers map to the same runtime session and default user.
- Same-context Bob reaches Alice sandbox environment and reads Alice secret.
- Fresh-context and principal-bound controls separate.

## Impact

A remote A2A correlation id becomes authority over multiple runtime resources:
the runner session, default user key, interrupt key, and sandbox environment.
In the reproduced case, Bob reuses Alice's `context_id` and reaches Alice's
sandbox state rather than receiving a fresh isolated environment.

For an A2A runtime that serves more than one caller, this can disclose
conversation memory, intermediate agent state, sandbox files, tool outputs, or
other data stored under the runtime session. It can also confuse provenance:
later messages from Bob are processed as a continuation of Alice's runtime
session, so future agent decisions may be based on mixed caller state.

The included negative controls show the intended separation is possible when a
trusted principal is supplied. The issue is the fallback path where
caller-controlled `context_id` is promoted into the only effective runtime
identity.

## Suggested Fix

Include a trusted caller/tenant identity in runtime session, interrupt, and sandbox keys. Treat A2A `context_id` as caller-controlled and insufficient by itself.

**Attachments**

[attachments.zip](https://github.com/user-attachments/files/29894666/attachments.zip)