fix: isolate raw tool payloads in session snapshots

[ningyixi]

SessionAccumulator retains raw tool input/output by reference. Mutating a received notification's nested payload changes the accumulated state and existing snapshots; mutating a returned snapshot likewise changes subsequent snapshots and the source notification. Other tool fields, such as content and locations, are already copied at these boundaries.

Deep-copy raw_input and raw_output when applying start/progress notifications and when building tool-call snapshots. This keeps nested payload mutations isolated while preserving the existing update/merge semantics and public interfaces. Document the payload-isolation behavior.

Four public-API regression cases exercise both notification types and both mutation directions, checking nested input and output payloads, existing snapshots, fresh snapshots, and source notifications. Before the fix, all four fail on base bdb9ac7; the five existing accumulator tests pass.

Validation on Python 3.14.8:

• Accumulator tests after the fix: 9 passed.
• make check: passed (lockfile consistency, all configured prek hooks, full ty and deptry).
• make test: 412 passed, 1 skipped, including doctests and local stdio/HTTP/WebSocket tests. The optional Gemini CLI smoke test retains its default skip. No model API calls were made.
• git diff --check: passed.

AI assistance: prepared and verified with Codex during a user-authorized contribution search.

[PsiACE]

Thanks for the fix and regression tests!