Python: fix(core): restrict unpickler module-prefix allowlist to types only

[HaoJun (White-Mouse)]

Motivation & Context

The restricted checkpoint decoder allows framework and OpenAI SDK types by module prefix. The previous implementation returned any global from those modules, and the allowlisted builtins.getattr could also traverse attributes on an allowed type. Together, those behaviors allowed a crafted pickle to reach a non-type callable such as _RestrictedUnpickler.__init__.__globals__["pickle"].loads before the post-deserialization type check.

This change tightens that defense-in-depth path while preserving the checkpoint format and supported type reconstruction.

Description & Review Guide

• What are the major changes? Package-prefix and caller-supplied allowlist entries must resolve to a type. During restricted unpickling, builtins.getattr is replaced with a resolver that only permits type-to-type attribute lookup. Regression tests cover non-type globals, legitimate nested-type lookup, and the full getattr/__globals__/inner-pickle.loads chain.
• What is the impact of these changes? Valid built-in, framework, OpenAI SDK, explicitly allowed, and nested type reconstruction remains supported. Non-type globals and non-type attribute traversal are rejected with pickle.UnpicklingError.
• What do you want reviewers to focus on? Please review the compatibility boundary of the restricted getattr replacement and whether the regression coverage captures the expected nested-type reconstruction cases.

Related Issue

Fixes #7432

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[HaoJun (White-Mouse)]

@microsoft-github-policy-service agree

[Copilot]

Pull request overview

Tightens the Python checkpoint restricted unpickling boundary by preventing agent_framework.* and openai.types.* module-prefix allowlisting from returning non-type globals (e.g., functions/modules), mitigating gadget chains that can pivot via builtins.getattr.

Changes:

• Updates _RestrictedUnpickler.find_class to resolve globals under allowed prefixes and permit them only if they are actual type objects.
• Adds a dedicated UnpicklingError message for blocked non-type globals from allowed prefixes.

[Evan Mattson (moonbox3)]

HaoJun (@White-Mouse) thanks for your contribution. Is there an open issue we can link to? Additionally, please help to fix the merge conflict.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/core/agent_framework/_workflows
_checkpoint_encoding.py	110	2	98%	160, 327
TOTAL	46675	4486	90%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9614	34 💤	0 ❌	0 🔥	2m 35s ⏱️

[Evan Mattson (moonbox3)]

Quick ping on this - let me know if you need help getting it across the finish line. Thank you.