[Bug]:RealtimeAgent tool call path allows remote users to trigger server-side Python execution when execute_python_code is exposed

**Describe the bug**
When an AgentScope RealtimeAgent session exposes `execute_python_code` as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, `RealtimeAgent._acting` forwards the model-produced tool call to `Toolkit.call_tool_function`, which invokes `execute_python_code` without an additional approval or isolation boundary on that path.

**To Reproduce**
Steps to reproduce the behavior:

1. Use AgentScope `1.0.19.post1` and start the realtime voice agent service with `execute_python_code` included in the session tool list.

2. Connect a WebSocket client to the realtime endpoint, for example:

```text
ws://127.0.0.1:8010/ws/test-user/
```

3. Create a realtime session and send a user message asking the agent to call `execute_python_code` once with a marker-writing Python snippet:

```python
from pathlib import Path
Path(r"\agentscope-realtime-marker.txt").write_text(
"AGENTSCOPE_REALTIME_REPRO",
encoding="utf-8",
)
print("done")
```

4. Observe that the service forwards the tool call through:

```text
src/agentscope/agent/_realtime_agent.py:RealtimeAgent._acting
src/agentscope/tool/_toolkit.py:Toolkit.call_tool_function
src/agentscope/tool/_coding/_python.py:execute_python_code
```

5. Check the marker file on disk.

**Expected behavior**
A remote realtime user should not be able to cause server-side Python code to run unless an explicit approval, sandbox, or equivalent containment boundary is enforced before the tool invocation.

**Error messages**
No exception is required to reproduce the issue. In the validated run, the tool result returned successfully with return code `0` and stdout containing:

```text
done
```

The marker file was created with:

```text
AGENTSCOPE_REALTIME_REPRO
```

**Environment (please complete the following information):**

- AgentScope Version: `1.0.19.post1`; also source-continuity checked in `1.0.18` and `1.0.19`
- Python Version: Python `3.12` in the local validation environment
- OS: Windows

**Additional context**
This report does not claim that every RealtimeAgent deployment is affected by default. The confirmed affected condition is a RealtimeAgent WebSocket service/session where `execute_python_code` is registered or exposed to model tool calls without an additional approval, sandbox, or containment boundary.