fix(adk): validate ask_user questions - #14

Summary

Validate built-in ask_user inputs in both Go and Python ADK runtimes before confirmation handling.

Problem

Both implementations accepted:

• an empty questions list; and
• question entries whose question text was empty or whitespace-only.

Those invalid tool calls could request confirmation and pause the task without presenting a usable question. An invalid model tool call should return an error that the model can correct; it should not create an unanswerable input-required interaction for the user.

Change

Both runtimes now:

• require at least one question;
• require nonblank question text for every entry;
• reject invalid input before calling the confirmation mechanism; and
• preserve existing pending and confirmed behavior for valid questions.

The tool descriptions also tell the model to provide at least one question. Runtime validation remains authoritative and does not depend on a model provider enforcing generated schemas.

Scope

This PR changes built-in ask_user validation only. It does not change A2A identity propagation, task persistence or exact task reads, confirmation transport formats, or client-side parsing and presentation.

Tests

Go:

• go test -race ./adk/pkg/tools
• go test -race ./adk/pkg/agent
• go test -race ./adk/...
• go build ./adk/...

Python:

• uv run pytest packages/kagent-adk/tests/unittests/test_ask_user_tool.py packages/kagent-adk/tests/unittests/test_hitl.py -q
• uv run pytest packages/kagent-adk/tests -q
• uv run ruff format --check ...
• uv run ruff check ...
• uv build --package kagent-adk

Regression coverage verifies empty-list rejection, blank-text rejection, no confirmation call for invalid input, and unchanged valid pending/confirmed behavior in both runtimes.

Sanitized integration validation

Using an independent pure-A2A client against a private compatible v0.10 test deployment, the valid Python-runtime path produced one nonblank structured question with bounded choices. A later client process answered the retained interaction, and the same task reached terminal completion without resending the original request.

Invalid input rejection is established by the focused Go and Python unit tests; the live exercise verifies that the valid interaction path remains intact.

Intended upstream issue: kagent-dev/kagent#2468.