Use versioned Redis keys for session identity

[srkyn]

Fixes #7464

Change

Redis session, user-state, and app-state keys now use distinct type tags and unpadded Base64URL identity components under a versioned v2: namespace. With the default prefix, new keys start with adk:session:v2:. Reads and appends reject mismatched stored session identities; deletion addresses the exact v2 key. Listing also confirms each scanned key is the canonical v2 key for its stored identity, so a legacy key that matches the scan pattern is ignored. A watched transaction keeps session and state writes together when appending events.

Compatibility

This is a cutover, not an automatic migration. Existing Redis keys stay untouched and are not read by the new format. The README describes expiry and careful manual cleanup. There is no legacy read fallback because ambiguous old keys could preserve the original alias. This PR is a draft so maintainers can decide whether that cutover is acceptable or prefer a specific migration plan. The existing same-identity append retry behavior after a concurrent deletion or expiry is unchanged.

Testing

• On the current pushed commit, 649 Redis and session tests passed (10 warnings), including 45 focused Redis tests for tuple/type isolation, legacy-key overlap, byte-returning clients, concurrency, and Runner isolation.
• Local Redis 7.0.15 on the current commit: an overlapping legacy key stayed unread and untouched; valid v2 listing worked with decoded and byte-returning clients. The synthetic keys were removed and a prefix scan found none remaining.
• Ruff passed. Pyink left the two changed Python files unchanged, with a Python 3.13 versus 3.15 parser warning. git diff --check passed.

[gemini-code-assist]

Code Review

This pull request migrates the Redis session service to a new versioned key schema (v2) using unpadded URL-safe Base64 encoding to prevent key collisions, and adds identity verification checks across session operations. The review feedback suggests reverting the transaction-based delete in delete_session to a direct delete to improve performance and avoid blocking the deletion of corrupted sessions. Additionally, it recommends using exists instead of get in append_event to prevent redundant double-reading and parsing of large session JSONs.