fix(tools): fail-closed when require_confirmation callable returns non-bool

[FOWEPJF255]

Summary

• Fail closed when a FunctionTool or MCPTool confirmation predicate returns a non-boolean value, including None from an unhandled branch.
• Cover the newer FunctionNode confirmation path: None requires confirmation, while other results retain its existing truth-value behavior (including the empty-string predicate case).
• Add regression coverage for all three paths and preserve the existing confirmation and resume behavior.

Fixes #7010

Testing plan

• Added or updated focused regression tests in the function-tool, MCP-tool, and workflow-node test modules.
• Ran all three modules on Windows with Python 3.14.3: 231 passed.
• ruff check passed on all six changed files.
• pyink --check passed on the changed workflow source and test files.
• Reviewed the diff for whitespace and UTF-8 encoding issues.
• Full multi-version tox suite and manual end-to-end run were not performed.

The workflow regression drives an in-memory Workflow through the confirmation pause and approved resume; it checks that the guarded node does not execute before approval.

AI disclosure: Assisted by an AI coding agent; I reviewed the change and can explain and maintain it.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Somay-kousis]

Ran this merged onto current main. main got require_confirmation on FunctionNode in 988fd1a (12 Oct), and _check_require_confirmation at src/google/adk/workflow/_function_node.py:776 still returns bool(...), so the None case from #7010 still skips the gate there:

# predicate returns True for /prod paths, falls through (None) otherwise
FunctionTool.check_require_confirmation(/home/x) -> True
FunctionNode path=/prod/db: ran without confirmation -> []
FunctionNode path=/home/x: ran without confirmation -> ['/home/x']

One catch before copying the isinstance check over: main's test_node_require_confirmation_callable_predicate uses a predicate that returns "" for no confirmation, and isinstance(result, bool) fails it. True if result is None else bool(result) in _function_node.py closes the hole and keeps that file's confirmation tests green.

[FOWEPJF255]

Thanks for spotting the new FunctionNode path. I updated this PR on current main so a predicate returning None requests confirmation there, while an empty string keeps the existing no-confirmation behavior. I also extended the workflow regression and added MCP-tool coverage. The three relevant test modules pass (231 tests), and Ruff and Pyink checks pass on the changed files.