Motivation & Context

SerializationMixin.from_dict() can unexpectedly mutate nested dictionaries in the caller-provided input when dictionary-shaped dependencies are merged during deserialization.

The method creates a shallow copy of the input dictionary, so nested dictionaries remain shared with the original input. The subsequent in-place .update() operations therefore modify the caller's input.

This can cause unexpected state to persist when the same serialized specification is reused across multiple from_dict() calls. In particular, dependency data injected during one reconstruction can leak into subsequent reconstructions.

This change fixes that behavior while preserving the existing dictionary dependency merge semantics and dependency precedence.

Description & Review Guide

• What are the major changes?

  • Replaced the two in-place dictionary .update() operations in SerializationMixin.from_dict() with non-mutating dictionary merges.
  • Added regression tests covering both dictionary dependency merge paths.
  • Added coverage to verify that repeated from_dict() calls using the same input do not leak dependency state.
  • Added coverage to verify that existing dependency override/merge behavior is preserved.

• What is the impact of these changes?

  • The caller-provided input dictionary is no longer modified by dictionary dependency merging.
  • Existing dictionary merge behavior remains unchanged, including dependency values overriding conflicting keys.
  • No public API or serialization format is changed.
  • This is a focused bug fix with no intended impact on unrelated serialization or dependency-injection behavior.

• What do you want reviewers to focus on?

  • Whether the non-mutating dictionary merge is the appropriate way to preserve the existing dependency merge semantics.
  • Whether the regression tests adequately cover both dependency merge paths and prevent cross-call state leakage.

Related Issue

Fixes #7899

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the [Contribution Guidelines](https://github.com/microsoft/agent-framework/blob/main/CONTRIBUTING.md)
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change.