Support A2A v1.0 agent cards #92

Summary

pkg/agentcard.AgentCard models the 0.3 card shape. Its doc comment says so: "based on v0.3.0 specification". A2A v1.0 restructured the card, so a valid v1.0 document does not round-trip through this type.

What changed in v1.0

Source of truth is specification/a2a.proto, message AgentCard.

protocolVersion, url and the transport binding moved off the top level into per-interface entries under supportedInterfaces:

{
  "supportedInterfaces": [
    {"url": "https://example.com/a2a", "protocolBinding": "JSONRPC", "protocolVersion": "1.0"}
  ]
}

Required top-level fields are now name, description, supportedInterfaces, version, capabilities, defaultInputModes, defaultOutputModes, skills. provider became optional, and requires both organization and url when present.

Other differences worth noting:

• protocolVersion is written as major.minor ("1.0"), not a semver triple. Validators that require three segments reject the spec's own notation.
• protocolBinding is an open-form string. JSONRPC, GRPC and HTTP+JSON are the officially defined bindings, but the spec explicitly permits others, so an unrecognised binding is not an error.
• An AgentInterface.url may be a host:port address for gRPC rather than an absolute URL.
• tags is required on AgentSkill.
• supportsAuthenticatedExtendedCard moved to capabilities.extendedAgentCard.
• capabilities.stateTransitionHistory was removed.

Scope

• Model supportedInterfaces and the v1.0 required set
• Detect which generation a document uses and validate against the matching rules, rather than assuming one
• Keep accepting 0.3 cards; both generations are in circulation
• Accept both 1.0 and 1.0.0 forms of a protocol version
• Treat an unrecognised protocolBinding as a warning, not a failure
• Update pkg/scoring/compliance.go, which checks the 0.3 required-field set and transport enum

Notes

Verification is unaffected by the shape change, since the canonical payload is computed from the received document rather than the struct (see #90). But pkg/scoring will score a valid v1.0 card as non-compliant until this lands, and callers cannot read supportedInterfaces at all.