[checkpoint] Restore indirect prompt-injection environments #3240

Parent

Child of #3219 and #3024.

Problem and state owner

resources_servers/indirect_prompt_injection/app.py owns a deep-copied nested mutable environment dictionary modified by dynamic tool routes.

Proposed adapter

Deep-snapshot the complete environment, bind it to replacement identity, and classify every dynamic tool route as a mutation.

Implement explicit checkpoint opt-in, route classification, export/restore/retire hooks, execution-to-session binding, revision reporting, atomic replacement under attempt N+1, and stale-attempt fencing.

Acceptance criteria

• Nested tool mutations survive restore, shallow-copy aliasing is absent, and verification retires the replacement state.
• Checkpoint after multiple mutations, replace the server process, restore, and compare the next operation with an uninterrupted execution.
• Corrupt or incomplete bulk state activates no sessions.
• Attempt N cannot mutate or retire restored attempt N+1.
• Terminal cleanup is idempotent and releases restored state exactly once.