fix(agents): prevent parent authorized_imports from leaking into managed agents on from_dict

[VANDRANKI]

Summary

When a CodeAgent with managed sub-agents is deserialized via from_dict(), the parent agent's additional_authorized_imports overwrites every child agent's own import allowlist. Reproducer from issue #1849:

sub_agent = CodeAgent(
    tools=[], model=model,
    additional_authorized_imports=['sympy'],
    name='sympy_agent',
)
main_agent = CodeAgent(
    tools=[], model=model,
    additional_authorized_imports=['numpy'],
    managed_agents=[sub_agent],
)
restored = CodeAgent.from_dict(main_agent.to_dict())
# 'sympy' not in restored.managed_agents['sympy_agent'].authorized_imports  <- BUG

Root cause

CodeAgent.from_dict() builds code_agent_kwargs containing additional_authorized_imports from the current agent's serialized dict, then calls super().from_dict(agent_dict, **code_agent_kwargs). MultiStepAgent.from_dict() forwarded those kwargs unchanged to every managed agent via agent_class.from_dict(managed_agent_dict, **kwargs). Because the parent's additional_authorized_imports is in kwargs, it overwrites the child's own value.

Fix

In MultiStepAgent.from_dict(), filter out CodeAgent-specific keys (additional_authorized_imports, executor_type, executor_kwargs, max_print_outputs_length, code_block_tags) before passing kwargs to managed agents. Generic overrides like model= are still forwarded tree-wide.

This preserves the existing behavior where callers can do from_dict(d, model=new_model) to inject a model into the whole agent tree, while ensuring each agent's import allowlist is always reconstructed from its own serialized data.

Test

Added test_from_dict_managed_agent_authorized_imports_not_leaked in TestCodeAgent that verifies a child agent with ['sympy', 'math'] imports retains them after a parent with ['numpy', 'pandas'] is deserialized.

Fixes #1849