Python: Fix checkpoint state isolation

[Patel Namraa (Namraa310806)]

Motivation & Context

Checkpoint state is currently not isolated at two boundaries:

1. State.export_state() / State.import_state() perform shallow copies, allowing
   nested mutable state to remain aliased between a checkpoint and live workflow
   state. A resumed workflow can therefore mutate the checkpoint it was restored
   from.

2. InMemoryCheckpointStorage deep-copies on save() but returns its internally
   stored checkpoint objects directly from load(), list_checkpoints(), and
   get_latest(). Callers can therefore mutate the storage backend's internal
   state through a returned checkpoint.

This can silently corrupt checkpoint snapshots without raising an exception.

This PR fixes both isolation gaps while preserving the existing checkpoint value
contract. Instead of copy.deepcopy(), it uses a pickle round-trip for isolation,
matching the serialization boundary already used by checkpoint persistence
backends. This is important because checkpoint values may be custom
pickle-serializable types that do not support copy.deepcopy().

Fixes #7683.

Description & Review Guide

What are the major changes?

• Added a shared isolate_checkpoint_value() helper using a pickle round-trip.
• Updated State.export_state() to isolate nested mutable values when creating
  checkpoint state.
• Updated State.import_state() to isolate incoming checkpoint state before
  merging it into live state.
• Updated InMemoryCheckpointStorage.load(),
  list_checkpoints(), and get_latest() to return caller-owned checkpoint
  objects.
• Preserved save() snapshot semantics by isolating the checkpoint at save time.
• Documented the ownership contract directly on the CheckpointStorage protocol.
• Added a parametrized checkpoint-storage conformance suite covering both
  InMemoryCheckpointStorage and FileCheckpointStorage.
• Added regression coverage for a value that is pickle-serializable but
  intentionally not deepcopyable, ensuring the fix does not reproduce the
  correctness regression identified during review of Python: Isolate checkpoint state from live workflow state across restoration and storage boundaries #7697.
• Added state-level tests covering nested mutable values across export/import.

What is the impact of these changes?

Checkpoint objects are now isolated from live workflow state and from storage
backend internals at the relevant ownership boundaries.

The change does not alter the checkpoint value contract to require
__deepcopy__ support. Isolation uses the same pickle-serialization semantics
already supported by checkpoint persistence.

The pickle round-trip is only performed at checkpoint export/import and storage
save/read boundaries; normal State.get(), set(), and commit() operations
are unchanged.

What do you want reviewers to focus on?

Please focus on:

• Whether the ownership boundaries are correctly defined between State,
  WorkflowCheckpoint, and CheckpointStorage.
• Whether pickle round-trip isolation is the appropriate mechanism instead of
  copy.deepcopy(), particularly for custom pickle-serializable checkpoint
  values.
• Whether the storage conformance tests adequately verify caller ownership and
  repeated-read independence.
• Whether the protocol ownership contract accurately describes the expected
  behavior for all checkpoint storage backends.

This PR incorporates the useful ownership-contract and conformance-test
direction discussed in #7697 and #7712, while avoiding the copy.deepcopy()
approach that was identified during review of #7697 as potentially breaking
previously valid pickle-serializable checkpoint values.

Related Issue

Fixes #7683

An existing PR, #7697, addresses the same issue but uses copy.deepcopy() for
isolation. Review identified that approach as a potential correctness regression
because pickle-serializable checkpoint values are not necessarily
deepcopyable.

This PR takes a different implementation approach using pickle round-trip
isolation and incorporates the relevant ownership-contract and conformance-test
feedback from #7697 and #7712.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Patel Namraa (Namraa310806)]

Context on why this PR exists alongside #7697

I opened issue #7683 and started working on a fix myself. While I was doing that, #7697 was opened independently and got ahead of my work. I read through that PR and its review discussion in detail, and the automated review surfaced a correctness concern with its copy.deepcopy() approach: applying deepcopy at the State.export_state() / import_state() and InMemoryCheckpointStorage boundaries can reject checkpoint values that are pickle-serializable but not deepcopyable (for example, custom types with __reduce__ but no __deepcopy__). This can narrow the existing checkpoint value contract. As of this comment, that concern remains unresolved on #7697.

I therefore finished my implementation using a pickle round-trip for isolation instead of deepcopy. This matches the serialization boundary already used by checkpoint persistence and does not require __deepcopy__ support. I also incorporated the useful ownership-contract and conformance-test feedback from the #7697/#7712 review discussion, including async tests, a backend-agnostic conformance suite, and coverage for both InMemoryCheckpointStorage and FileCheckpointStorage.

I recognize that having two open PRs for the same issue isn't ideal, so I'm calling out the overlap explicitly rather than leaving it ambiguous. I'm happy to close or defer this PR if a maintainer prefers to continue with #7697; my goal is to make sure the checkpoint isolation fix lands without the deepcopy compatibility issue identified during review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.