fix: bubble up subagent HITL approval to parent agent

When subagents with HITL-enabled tools enter input_required state, the
parent agent now detects this from the A2A response metadata and
propagates the approval request to the top-level chat. On resume, the
decision is forwarded directly to the subagent via its A2A client,
and the parent agent re-runs to process the result.

Key implementation details:
- Detect subagent input_required via ADK event custom_metadata
- Persist subagent HITL context in session state for resume
- Forward decisions to subagents with 5-minute timeout
- Clear HITL state after successful forwarding
- Use SubagentForwardResult NamedTuple for type-safe return values
- Extract shared helpers to avoid code duplication
- Prefer public APIs with private API fallbacks for forward compat
- Emit terminal failure events for all error paths
- Add comprehensive unit tests for all helper methods

Fixes #1475

Signed-off-by: Jaison Paul <paul.jaison@gmail.com>

Author: jsonmp-k8