Migrate four samples to core/python recipes; fill AGENTS.md for memory/oauth

[eliasecchig]

Summary

• Migrate the four documented "Other samples" from python/agents/ into core/python/ as curated recipes: ambient-expense-agent, deep-search, safety-plugins, genmedia-for-commerce.
• Copies only — the originals under python/agents/ are left byte-for-byte unchanged for retro-compatibility.
• Fill in the previously empty AGENTS.md files for the two already-migrated recipes (cross-session-memory, oauth-user-consent-flow).
• Standardize agent/LLM models on gemini-3.5-flash (and gemini-3.1-flash-lite for flash-lite) across the recipes.
• Fix a pre-existing bug in the oauth recipe's Makefile.

Changes

1. New core/python/ recipes (4) — each brought to recipe standard per docs/recipe-guidelines.md: manifest.yaml (ownership set), AGENTS.md (clone-and-study format matching the RAG recipes), .env.example, tests/test_runnability.py, aligned pyproject.toml, regenerated uv.lock, ruff-clean.

• Ownership: ambient-expense-agent & deep-search → DevRel Cloud AI (eliasecchig); safety-plugins → DevRel Cloud AI (tommywagz); genmedia-for-commerce → FDE (lspataroG).
• ruff: trivial violations auto-fixed; structural/idiomatic ones (complexity, FastAPI Depends, deliberate late imports) carry targeted # noqa rather than refactors, to preserve the shipped samples' behavior.

2. AGENTS.md for cross-session-memory & oauth-user-consent-flow — both shipped as 0-byte placeholders; populated in the same clone-and-study format as the RAG recipes (Intent, When To Use, Eval, End-to-end flow, Most interesting files, Data handling, Gotchas, Where to run things, Reuse).

3. Model standardization → gemini-3.5-flash — updated agent/LLM model config (and synced AGENTS.md/README references) for ambient-expense-agent, deep-search, safety-plugins, cross-session-memory, oauth-user-consent-flow (including its eval judge). Flash-lite models → gemini-3.1-flash-lite.

• Not touched (correctly non-chat models): Veo, gemini-3.1-flash-image-preview, gemini-embedding-*, imagen-*.
• genmedia-for-commerce is intentionally left on its original model set.

4. Fix oauth-user-consent-flow/Makefile — deploy/eval targets referenced a nonexistent adk_ae_oauth/ package (leftover template name); repointed at the real app/ package so make deploy / make eval work.

Validation

• uv run validate structure and uv run validate manifest pass for all six core/python recipes.
• uv run ruff check clean for all four new recipes.
• Runnability tests compile (and pass with model env set).