Add C# content to the Self-hosting doc, including session storage customization (match Python coverage)

Start with agent-framework/hosting/self-hosting/index.md and compare the existing Python pivot with the C# stub. Verify the documented .NET APIs in Microsoft.Agents.AI.Hosting and Microsoft.Agents.AI.Hosting.AspNetCore, including session stores and isolation options. Done means the C# section covers the equivalent hosting, persistence, and secure session-continuation guidance without leaving the current stub.

Summary

The Self-host Agent Framework applications doc has full Python coverage but only a "coming soon" stub for C#. The C# pivot should be filled in to match the Python content, and in particular should cover customizing session storage (and the related secure-session-continuation / principal-isolation guidance), which is where that content belongs — it's a general hosting concern, not specific to any one protocol integration.

Source file: agent-framework/hosting/self-hosting/index.md (in MicrosoftDocs/semantic-kernel-pr).

Current state

• C# pivot: "Self-hosting protocol helpers for .NET are coming soon." (stub)
• Go pivot: "not currently available for Go."
• Python pivot: fully documented, including:
  • What the hosting helpers provide (AgentState, SessionStore, WorkflowState)
  • Customize session storage — subclass SessionStore (get/set/delete), store AgentSession in Redis/DB/blob, AgentState(session_store=...), and the SessionStore vs. HistoryProvider distinction
  • Secure session continuation — treat protocol-provided IDs as untrusted; authenticate, authorize, and partition durable state per tenant/user

What the C# content should cover

The .NET hosting equivalents already ship and should be documented here:

• Registering a session store: IHostedAgentBuilder.WithInMemorySessionStore(bool withIsolation = true) and WithSessionStore(...) (namespace Microsoft.Agents.AI.Hosting), plus implementing a custom AgentSessionStore for Redis/DB/blob-backed persistence.
• Principal isolation for multi-user hosts: SessionIsolationKeyProvider and UseClaimsBasedSessionIsolation(...) (namespace Microsoft.Agents.AI.Hosting.AspNetCore). This is the C# analog of the Python "Secure session continuation" guidance and is a general hosting concern — the same isolation types are used by the AG-UI, A2A, and Foundry hosting integrations.
• Important default behavior to call out (verified): WithInMemorySessionStore() defaults to withIsolation: true, which requires a registered SessionIsolationKeyProvider. With no provider registered, requests fail closed with an HTTP 500 ("Session isolation key is required..."). Guidance:
  • withIsolation: false for single-user / local development.
  • UseClaimsBasedSessionIsolation(...) (or a custom SessionIsolationKeyProvider) for multi-user hosts.
  • Persistence is opt-in; by default a self-hosted agent endpoint is stateless.

Why now / context

While updating the AG-UI C# docs (PR #430), we drafted a "Persisting Sessions" section in the AG-UI getting-started. On review, server-side session storage + principal isolation turned out to be a general MAF hosting concern (shared by AG-UI, A2A, and Foundry hosting), not AG-UI-specific, so we removed it from the AG-UI getting-started. The Python docs already document it in one shared place — the self-hosting doc — and the C# content should live there too.