[Story] A2A protocol v2 handshake with JWT-SVID

[shreyanshjain7174]

Parent

Part of #146 (Cross-Cluster Agent Identity Federation epic).

Status

Blocked by validation gate. Coordinated with Workload API integration.

Goal

Extend the A2A protocol handshake with a v2 variant carrying JWT-SVIDs across trust domains, while remaining backward-compatible with v1 (operator-issued JWT).

Scope

• New header X-A2A-Version: 2 triggers SVID code path; absence = v1
• New header X-A2A-TrustDomain carries the claimer's trust domain
• Receiving agent:
  • Looks up trust bundle for claimed trust domain
  • Returns 403 untrusted_domain if bundle missing
  • Validates JWT-SVID signature against trust bundle
  • Extracts SPIFFE ID, applies A2A authorization policy
• Update agents/a2a/protocol.py with v2 schema
• Update agents/a2a/server.py to route on version header
• Update agents/a2a/client.py to advertise v2 when spiffe.enabled=true
• v1 (no version header) continues working indefinitely — no deprecation
• Unit tests: v1↔v1, v2↔v2, v1↔v2 (rejected gracefully), invalid SVID, untrusted domain

Reference

RFC-0001 § 4.3
agents/a2a/protocol.py

Acceptance

• All test combinations pass
• Wire format documented in docs/a2a-architecture.md
• Backward compat verified against existing demos