fix: namespace file artifacts by app

[pragnyanramtha]

Summary

• include app_name in FileArtifactService's on-disk namespace
• validate app_name as a path segment before building file paths
• add regression coverage for session-scoped and user-scoped cross-app isolation

Fixes #5618.

Context

FileArtifactService accepts app_name in the public artifact APIs, but stored artifacts under root/users/{user_id}/.... That lets two apps sharing a local artifact root read or list each other's artifacts when user_id, session_id, and filename match.

The file backend now stores data under root/apps/{app_name}/users/{user_id}/..., matching the API boundary and the other artifact service implementations. Existing files in the previous layout are not migrated by this focused bug fix.

Validation

• uv run --extra test pytest tests/unittests/artifacts/test_artifact_service.py -q -> 75 passed
• uv run --extra test pytest tests/unittests/artifacts -q -> 89 passed
• uv run --extra dev pyink --check src/google/adk/artifacts/file_artifact_service.py tests/unittests/artifacts/test_artifact_service.py -> passed
• uv run --extra dev isort --check-only src/google/adk/artifacts/file_artifact_service.py tests/unittests/artifacts/test_artifact_service.py -> passed
• python3 -m py_compile src/google/adk/artifacts/file_artifact_service.py tests/unittests/artifacts/test_artifact_service.py -> passed
• git diff --check -> passed

[pragnyanramtha]

Thanks for flagging the overlap on #5618. I’m closing this PR as a duplicate so review can stay focused on #5619, which came first and already includes the requested migration note.

Happy to help fold in anything useful from this branch if maintainers prefer a different direction.