fix(a2a): stabilize permission checkpoint identity

[guima-why]

Summary

• Treat staged permission backups as durable so staging-only backup mode still publishes permission_requested and INPUT_REQUIRED.
• Bind cloud permission checkpoints to stable STS GetCallerIdentity fields instead of rotating temporary AccessKey IDs.
• Revalidate only allow decisions; deny decisions do not need an identity lookup.
• Keep checkpoints unclaimed when identity lookup fails or the stable caller changes, allowing a safe retry.
• Cache caller identity once per StartChat request and retry only transient STS failures.

Stable identity

• Account: identity type + AccountId
• RAM user: identity type + AccountId + UserId
• Assumed role: identity type + AccountId + RoleId

Rotating AccessKeyId, security token, request ID, ARN session name, and PrincipalId session suffix are excluded.

Validation

• make lint
• 611 focused A2A, permission, pipeline, and restart E2E tests passed
• Full repository run: 15,337 passed and 192 skipped; the two Node-dependent checks were rerun with Node available and passed