Validate root task codecs before workflow and query interceptors

[rmcdaniel]

Problem

In main@876578333a32124a0658e0e64dff7e7ad619da0c and Python SDK 2.0.0-rc.32, the exact-Avro root task check runs inside the workflow and query core handlers. The public interceptor chains wrap those core handlers, so application interceptor code receives a task before its root payload_codec is validated. An interceptor can execute side effects, mutate an invalid codec to avro, or short-circuit the core entirely. Activity tasks already validate before their application interceptor, leaving the worker boundary asymmetric.

Acceptance criteria

• Require root payload_codec to be the exact string avro before invoking workflow-task or query-task interceptors.
• Missing, null, empty, JSON, unknown, wrong-case, and non-string root values fail with unsupported_payload_codec without invoking interceptors, payload decode, replay, query/update logic, or application handlers.
• An interceptor cannot turn an invalid task into an accepted task by mutating its context, and cannot suppress the required task failure by short-circuiting the core.
• Exact-Avro tasks preserve documented interceptor ordering, context, results, and exception behavior.
• Focused tests cover invalid workflow, workflow-update, and query tasks with side-effecting and mutating interceptors plus valid Avro controls.

Delete when

Delete when a published Python prerelease rejects every non-exact root codec before all application interceptor work and the focused valid/invalid controls pass against the published artifact.