fix(agent): rewind checkpoint to turn boundary on stream cancellation - #79

Describe what this PR does / why we need it

When a subscriber cancels a streaming run — SSE disconnect, flux.timeout, debugger pause — the in-flight turn could end up half-persisted in the checkpoint. Two observed variants:

• a dangling ASSISTANT(tool_call) with no following tool response (reproduced offline in this repository, see test), or
• a ToolResponseMessage whose preceding assistant tool_call never got persisted (reported in the linked issue).

Either way, the next turn loads an invalid message sequence and mainstream LLM APIs reject the request with 400 ("roles must alternate…").

Root cause: state merge + checkpoint persistence sit in processedFlux.concatWith(updateContextMono…) inside NodeExecutor.processGraphResponseFlux, so they only run when downstream demand pulls the tail — cancellation skips them, while nested async continuations may still land their own checkpoints.

This PR makes a cancelled turn behave as if it never happened:

1. GraphRunner.run marks the GraphRunnerContext cancelled on the stream's doOnCancel; addCheckpoint skips persistence when cancelled — with a re-check after the (potentially expensive) state clone, so in-flight completions racing the cancel cannot record a half turn.
2. ReactAgent.doStream snapshots the thread's pre-turn checkpoint at assembly time and, on cancellation, rewinds the saver to that snapshot via saver.put(config, Checkpoint.copyOf(...)) (an empty-state checkpoint for a first-ever turn).

Normal completion and error paths are untouched (doOnCancel does not fire on them).

Does this pull request fix one issue?

Fixes #25

Describe how you did it

• GraphRunnerContext: volatile cancelled flag + markCancelled(); addCheckpoint early-returns when cancelled (checked on entry and again right before the saver put).
• GraphRunner.run: attaches doOnCancel(context::markCancelled).
• ReactAgent.doStream override: pre-turn checkpoint snapshot + doOnCancel rewind; rewind failures are logged-and-swallowed so they never mask the cancellation.
• Issue25StreamCancelCheckpointTest (offline, stub streaming model + tool + MemorySaver):
  • full run persists a valid paired sequence (baseline);
  • cancelling mid-turn leaves no dangling fragment — after the fix the checkpoint is rewound to the pre-turn state (against main this test fails with USER -> ASSISTANT(tool_call));
  • disposing after completion keeps the full 4-message turn (guards against over-rewinding).

Describe how to verify it

mvn -pl agentic-spring-ai-agent-framework -am test -Dtest=Issue25StreamCancelCheckpointTest

Full module suite (mvn -pl agentic-spring-ai-agent-framework -am test, 649 tests) shows the same failure set as unmodified main (the pre-existing Windows symlink-privilege tests in FilesystemInterceptorTest / FileSystemToolsTest); no new failures.

Special notes for reviewers

Design note: rewinding to the turn boundary was chosen over salvage-on-cancel (cannot fix the dangling tool_call variant) and load-time sequence sanitization (masks the problem, silently rewrites history). A design summary was posted on issue #25 before this PR. Scope note: the rewind is wired at the Agent streaming layer; generalizing the cancelled-flag handling to other entry points can follow if the approach looks right.