Feature/auto link manual return

[Juan219]

Summary of changes

• Added support for PayPal Vault app switch manual return recovery by storing the pending billing agreement token and correlation ID before launching PayPal.
• Added auto-link tokenization for pending PayPal app switch sessions when the merchant app returns to the foreground, allowing the SDK to recover when no return URL is delivered.
• Updated PayPal Vault tokenization to reuse a valid pending app switch session on the next tokenize attempt, while clearing expired or completed sessions.
• Improved error handling so failed auto-link attempts do not prematurely call the merchant completion handler, allowing a later foreground event to retry recovery.
• Added PayPal auto-link analytics events for started, succeeded, and failed recovery attempts.
• Added unit coverage for pending session storage, session expiration, foreground recovery, retry behavior, checkout flow isolation, and return URL race prevention.
• Added an unreleased changelog entry for the PayPal auto-link manual return behavior.

AI Usage

Which AI Agent Was Used?

• Copilot
• Claude
• Other (GPT 5.5)

How was AI used?

AI was used for code generation, refactoring, debugging and writing tests

Estimated AI Code Contribution

• less than 30%
• 30 - 60%
• 60 - 100%

Checklist

• Added a changelog entry
• Tested and confirmed payment flows affected by this change are functioning as expected

Authors

List GitHub usernames for everyone who contributed to this pull request.

---

Inner Source Process

Internal to PayPal contributors should fill out this section. All others can delete.

PR should follow these steps before codeowners review will begin:

1. PR should be opened in a draft state with the tech lead review required, and inner source label
2. PR should be reviewed by and approved by your team's technical lead, we do not allow LGTM reviews, there should be comments and feedback provided on all PR reviews
3. Once the above steps are completed, the PR can be moved to ready to review with the tech lead review required label removed
4. PR comments must be addressed within 24 hours, if you are unable to address within this timeframe, move the PR back to a draft state so our team knows not to review

Inner Source Checklist

• Added all labels to the PR
• Provide steps to test the flows changed, if applicable in the summary
• Demo video of the functionality, if applicable
• All upstream dependencies are merged in and this PR can be released at any time; PRs should not be opened until this is true
• Unit tests and builds have been run locally and pass/compile as expected

[jaxdesmarais]

Closing due to inactivity. Reopen when this work is in a more final state. Additionally code changes should be kept as small as possible. This diff is quite large and will result in delays in review/approval - ensure you've broken this work down and can merge iteratively into a feature branch.