feat(a2a): add experimental A2A v1 protocol adapter

[Revinand]

Summary

Add an experimental, opt-in adapter for the A2A v1.0.0 protocol.

The adapter publishes Agent Commerce resources as A2A skills and maps JSON-RPC SendMessage requests onto the existing canonical execution pipeline, including free and x402-paid resource flows.

What changed

• Add A2A protocol configuration:
  • disabled by default
  • default mount path: /a2a
  • resources can opt in with expose: [a2a]
• Publish an A2A Agent Card at /.well-known/agent-card.json
  • derives skills from exposed canonical resources
  • identifies free and paid skills
  • advertises the JSON-RPC endpoint and supported protocol version
• Implement A2A v1 JSON-RPC transport:
  • supports SendMessage
  • requires the A2A-Version: 1.0 header
  • validates the structured resource invocation envelope
  • maps malformed and unsupported requests to standard JSON-RPC errors
• Map canonical execution outcomes to terminal A2A tasks:
  • successful delivery → TASK_STATE_COMPLETED
  • payment required or domain failure → TASK_STATE_FAILED
  • x402 proofs use the existing reserved _payment input field
• Extend the gateway adapter model with adapter-owned discovery routes
• Add mount-path conflict validation and preserve per-adapter startup/request isolation
• Expose A2A capabilities, status, and unsupported operations through gateway discovery and agent-commerce doctor
• Document configuration, invocation, payment, result mapping, and limitations
• Add unit, gateway integration, and official SDK-driven conformance coverage for discovery, free resources, paid resources, errors, and protocol negotiation

Supported scope

This initial implementation supports:

• A2A specification v1.0.0
• protocol negotiation version 1.0
• JSON-RPC binding
• Agent Card discovery
• synchronous SendMessage
• terminal task results
• free and x402-paid canonical resources

Streaming, persistent or resumable tasks, push notifications, multi-turn continuation, extended Agent Cards, A2A authentication schemes, REST, and gRPC bindings are intentionally not implemented.

Compatibility

A2A remains disabled unless explicitly enabled, so existing configurations continue to work unchanged. The official @a2a-js/sdk dependency is used only for conformance testing and is not required at runtime.