0.5.6: Add A2A 1.0 SDK and CLI support

[dimavrem22]

Decisions

• Wire compatibility: Preserve standard A2A 1.0 task and message payloads while exposing separate typed identity-history resources.
• History ownership: Expose one canonical ledger to both requester and worker instead of duplicating outbound records.
• History contract: Use optional AND-composed filters, explicit direction, opaque keyset cursors, and deterministic newest-first ordering.
• Lifecycle surface: Expose current task state and message history without publishing internal transition records.
• Bilateral admission: Require the requester identity's outbound policy and the worker identity's inbound policy to allow a protocol call; expose inbound, outbound, and both rule directions across Python, TypeScript, and CLI.
• Webhook ownership: Keep A2A, iMessage, and call-lifecycle events in separate identity-owned subscription rows while allowing disjoint rows to share a destination URL.
• Administration: Expose receiver filter mode, skill reset, and contact-rule CRUD across Python, TypeScript, and CLI; filter-mode and rule mutations require organization-admin authority.
• Credential containment: Fetch Agent Cards without credentials, refuse redirects, require canonical HTTPS URLs, keep credentials in client-private storage, freeze validated TypeScript targets, and attach an Inkbox key only when the card and selected RPC endpoint share the configured Inkbox origin.
• Request deadlines: Bound Python and TypeScript A2A requests through their parent SDK configuration, including requests already in flight while wait() enforces its deadline.
• Release scope: Ship the coordinated A2A surface as version 0.5.6 across Python, TypeScript, Rust, CLI, and public skills.
• Webhook conversation context: Reject non-null conversation context for A2A subscriptions across all SDKs because A2A events carry protocol context in their own payloads.

Changes

• Add Python and TypeScript A2A 1.0 clients for Agent Card discovery plus send, get, list, wait, cancel, and reply operations.
• Add standard status-timestamp filtering to Python and TypeScript task lists for incremental polling.
• Keep TypeScript resolved-target credentials non-enumerable through client-private storage, freeze validated targets, and enforce bounded card/RPC request timeouts.
• Propagate the parent Python and TypeScript SDK request timeout into identity-created A2A clients; cap each Python wait() poll request to the remaining wait deadline.
• Add Python, TypeScript, and Rust identity resources for inbound, outbound, or combined task, context, and message history, including explicit Rust context direction.
• Add typed Rust payload models for all four A2A webhook event types.
• Add requester, worker, direction, state, context, task, author-role, keyword, time, cursor, and limit filters where applicable.
• Add repeatable worker progress replies, receiver settings with inbound/outbound task totals, filter-mode updates, skill reset, contact-rule list/create/update/delete, replies, and Agent Card helpers.
• Support and validate inbound, outbound, and both contact-rule directions in Python, TypeScript, and CLI.
• Validate that each identity-owned subscription contains exactly one of the A2A, iMessage, or call-lifecycle event families.
• Reject mixed-family webhook updates and non-null A2A conversation context before sending requests in Python, TypeScript, Rust, and CLI-backed flows.
• Align A2A webhook payload types with emitted payloads: caller trust tier is not present, and message ID/parts are optional when an event has no message.
• Add CLI commands for filter mode, skill reset, and rule update/delete, and update Python, TypeScript, and CLI public skills and READMEs.

Compatibility

• Existing Python, TypeScript, and CLI methods are unchanged. Rust combined context history now takes A2AContextListOptions so callers can specify direction and pagination.
• History cursors remain opaque and must be reused with the same filters.
• Remote calling requires a claimed, identity-scoped key bound to the caller.
• Python and TypeScript accept both standard result envelopes and direct task payloads for compatibility with older A2A implementations.
• The matching server contract must be deployed before the new history, administration, and outbound-rule methods are used.

Related pull requests

• Public host integrations: Hermes PR 72, Claude Code PR 45, Codex PR 26, OpenCode PR 9, OpenClaw PR 43

Verification

• Python: Ruff passed; full suite 948 passed, 3 skipped.
• TypeScript: build passed; full suite 970 passed, 3 skipped.
• CLI: full suite 62 passed.
• Rust: formatting and full default suite passed; 197 tests passed; doc tests passed with 2 passed and 1 ignored.
• Exact unpublished PR source was validated directly rather than through registry releases.
• GitHub Python, TypeScript, Rust, CLI, and exact-source Python/TypeScript SDK integration checks are tracked on this PR.
• git diff --check: passed.