.NET: Define AgentIsolationKeyProvider lifetime

## Problem

Hosting services retain `AgentIsolationKeyProvider` in long-lived objects, but the provider's required dependency-injection lifetime is not documented.

The built-in claims provider is a singleton and works with the current design. A custom provider may instead be registered as scoped. Resolving that provider while constructing a singleton can fail scope validation or retain it beyond its intended scope.

This pattern is used by generic hosting, AG-UI, A2A, and the OpenAI hosting work in #8146.

## Options

### 1. Require singleton providers

Document singleton lifetime and concurrent-use safety as part of the provider contract. Add a supported singleton registration helper and use it for the built-in claims provider.

This matches the current architecture and is the smallest change.

### 2. Resolve providers from the active scope

Resolve the provider when a key is needed instead of retaining it. Supporting this across all hosting packages would require a transport-neutral scope accessor.

This supports scoped providers but requires broader changes.

### 3. Pass the key explicitly

Resolve the key at the transport boundary and pass it through storage operations.

This makes the isolation context explicit but requires changes across several APIs.

## Completion criteria

- [ ] Select and document the supported lifetime model.
- [ ] Apply it consistently across hosting, AG-UI, A2A, and OpenAI hosting.
- [ ] Provide and test the supported custom-provider registration path.
- [ ] Produce a clear error for unsupported configurations.

Start by comparing the provider usage in generic hosting, AG-UI, A2A, and OpenAI hosting, and read the related discussion in #8146. Decide which lifetime model the project will support, then trace its registration and resolution paths. Done means the model is documented and applied consistently, with custom registration tests and a clear unsupported-configuration error.

Written by the indexing model from the issue text.