Harden A2A safe mode and selling tools

[guima-why]

Summary

• Add opt-in A2A safe mode for deployed environments while preserving local behavior by default.
• Restrict unsafe tools in normal chat under safe mode, while keeping approved cloud, skill, and memory tools available.
• Constrain safe-mode file reads to the session directory, current working directory, and iac-code source directory.
• Harden pipeline interrupt handling so prompt-injection style supplement messages are classified as ignored instead of being injected into the active agent loop.
• Remove unnecessary selling pipeline exposure for ros_stack_instances and update user-facing safe-mode messages with translations.

Impact

This keeps auto_approve_permissions=True usable for A2A deployments while preventing deployed normal-chat sessions from freely invoking shell, file-write/edit, or MCP-style tools. Existing local behavior remains unchanged unless IAC_CODE_A2A_SAFE_MODE is enabled.

Validation

• make translate
• uv run pytest tests/tools/test_path_safety.py tests/services/permissions/test_pipeline.py tests/services/test_agent_factory.py tests/a2a/test_executor.py::test_executor_refreshes_cloud_tools_with_aliyun_metadata_for_reused_context tests/mcp/test_runtime_integration.py -q
• uv run pytest tests/tools/test_path_safety.py tests/services/permissions/test_pipeline.py tests/services/test_agent_factory.py tests/a2a/test_executor.py::test_executor_refreshes_cloud_tools_with_aliyun_metadata_for_reused_context tests/mcp/test_runtime_integration.py tests/pipeline/engine/test_loader.py tests/pipeline/selling/test_pipeline_reviewing.py tests/pipeline/selling/test_ros_template_tool_scope.py tests/pipeline/selling/test_memory_policy.py tests/pipeline/selling/test_deploying_prompt.py -q
• uv run ruff check src/iac_code/services/agent_factory.py src/iac_code/tools/path_safety.py tests/services/test_agent_factory.py tests/tools/test_path_safety.py