feat(application): follow conditional builders and owned agent fields

[pengfei-threemoonslab]

An application comparison can now read closed caller arguments when the builder constructs an agent inside an if/else, and can follow a capability field of an already identified SDK/ADK agent to its unchanged constructor list. Rows retain caller/construction conditions and the actual tool or handoff identity.

Refs #874. Stacked on #1016 (codex/912-source-identity). This bounded increment leaves custom self.tools, concrete-subclass/template expansion and full #874 acceptance open. The owner deferred corpus, ledger, Q2 and released-build baseline work to separate implementation.

Boundaries

• Unreachable branches, loops, handlers, nested builders and methods keep their existing caller-flow limits.
• Field reads require both container ownership and proof that the field still equals its constructor value, including the defining factory and returned/cross-file handles.
• Replacements, deletion, augmented assignment, mutation, escaping handles and ordinary name-alike objects remain unread. No constructor, namespace or handle proof was relaxed.
• No golden, baseline, waiver, schema or CI workflow changes.

Authorship

• A coding agent wrote some or all of this change. Agent: Codex.
• A person read the whole diff before opening this pull request.

Validation

• 48 new tests passed: SDK/ADK branches, genuine application additions, tools/handoffs/sub-agent reads, direct and factory replacements, mutations/escapes and name-alike/custom-instance limits.

• Related selection before final fixes: 3,316 passed, 120 existing expected-failure cases.

• Final affected builder/list/object-ownership selection: 1,283 passed, 120 existing expected-failure cases.

• Source-identity/application-review/shard compatibility selection: 71 passed.

• Ruff and diff whitespace checks passed. New shard weights have measured JUnit provenance; full-suite weights remain intact.

• Original committed-source verifier/control at bef21d5ac7bf: complete, release decision passed.

• Original exact-head GitHub CI at bef21d5ac7bf: all 14 applicable checks passed; release-tag-only check skipped.

• Sequential restack at 73c42ad419e1: source patch retained; 48 flow tests passed with preceding increments. Test-only EOF whitespace fixed. Committed control is complete / passed; exact-head GitHub CI passed all 14 applicable checks, including six suite shards and aggregate coverage; the release-tag-only check was skipped.

• Final unchanged-source six-increment combination at a4ea56e5987bf: 1,546 tests passed, 1 skipped; independent combination review passed 383 tests with no actionable P1/P2. No corpus or baseline was scored.

Independent review and fixes

1. Found a P2: container ownership allowed a field replacement, so a later construction could read the old initializer and report a nonexistent added tool. Added an independent unchanged-field proof and a real Git/CLI regression.
2. Found the same P2 inside a returned factory: proof started at the caller handle, missing writes in the defining function. The recursive field reader now checks the actual constructor owner too, with paired positive/negative cases.
3. Final read-only review found no remaining actionable issues and independently passed all 48 new tests. Additional probes covered cross-file factories and SDK MCP fields, including replacement refusal. The agent implemented all fixes; reviews did not score a corpus.

Ordered merge preparation

This increment was replayed onto main c5ba436e09bc, after #1016. New head 46e404e1b639 has exactly the same file content as reviewed head 73c42ad419e1 (full-tree diff equality). Fresh committed control is complete / passed; exact-head CI for the replay passed all 14 applicable checks; release-tag-only check skipped. The preceding main commit passed all 13 CI jobs before this merge. Baseline implementation remains deferred.

Post-merge main verification

Squash-merged as 337fb5cd44ebd815b85a6ec61f1c96bd72626d85. The main tree exactly matches the reviewed PR head. Post-merge targeted tests passed: 48 tests. Fresh committed verification on that main commit returned complete / passed. Main CI run completed successfully with all 13 jobs passed. Baseline, corpus, ledger, Q2 and released-build evaluation remain deferred.