fix: propagate context into handler workers

[zhongkechen]

Fixes #428.

Carry invocation-start context into the SDK-owned handler worker so ordinary user spans and logs inherit the durable trace. Opted-in Invocation/Execution scopes bind the existing Invocation/Workflow span when the ambient parent is absent or unrelated, retain valid same-trace parents and baggage, and restore context on return, failure or suspension.

Isolate plugin-bearing invocation context from the host. Failed startup or scope-entry bindings are discarded before subsequent setup and user code; finalizers retain the Context that owns their tokens. Existing hook threads/order, result/exception identity and the no-plugin path are preserved.

Optional scopes require literal __durable_handler_context_api__ = 1 on the concrete class. The generic base provides no marker/default hook, so old helpers, properties and dynamic attributes remain untouched; custom subclasses explicitly redeclare the marker. Provider API 1, dependency floors, plugin lifetime and checkpoint/replay formats are unchanged. This fix is independent of #737. Supported older cores load the new plugin and retain their existing tracing behavior; the new worker-scope behavior requires the updated core.

Validation:

• Full core: 1,843 tests plus 5 subtests (98.28% coverage). Full workspace OTel: 469 tests. The distinct test-pypi-otel-minimum lane pins actual installed core 2.0.0 and passes all 362 pre-existing-suite cases plus 14 valid registration cases; exact version, site-packages import and absence of the new handler API are asserted. The separate installed core 2.0.x legacy lane passes 14 cases. Repository type checks, formatting and workflow wiring pass. The capable installed-core lane requires core 2.1+ and was not run locally; runtime dependencies still support core 2.0.0.
• Real public worker/step/wait/resume coverage includes both OTel views, plugin order, same/unrelated/absent parents, baggage, success/failure, completed-body suppression and caller restoration. Sampled/unsampled direct scopes also preserve cleanup and exception identity.
• Negative controls: 27 partial-setup cases, 11 legacy-hook collision cases and 26 Execution-scope cases fail before their respective fixes. The final context/compatibility suite passes 74 cases; the extended OTel scope matrix passes 98 focused cases.
• Four actual installed core/plugin pairs pass 24 legacy helper/property/dynamic lookup + wait/resume/context-cleanup cases. Imports and final wheel contents are verified.
• A deterministic concurrent stdout regression fails with concatenated JSON before the fixture output lock; all 11 normal-conformance package tests pass. Expected log records and wait timings remain unchanged. Recurrent layer lookup throttling uses bounded standard retries scoped only to that read; test timeouts and assertions are unchanged.

Cross-SDK conformance coverage is in #758 and aws/aws-durable-execution-conformance-tests#131. Current-head CI and actual AI review generation/posting are monitored separately.

[github-actions]

Codex AI review

No actionable findings. Residual risk is limited to the updated external workflow pin and cloud-only retry path, which were not executable under read-only review constraints.

Reviewed commit 176026b221e2c5aec495719efa481a424c07bbf5. Workflow run