feat(core): build the A2A handler in core instead of exposing it to extensions

[jjamroga]

The A2A gateway should not be injectable. It is a core component, not a policy
decision, and the only parts of it an extension should influence are the ones it
already supplies through pluggable interfaces: Authenticator and Authorizer.

Today ExtensionConfig.A2AHandler inverts that — the one gRPC service that reaches
agent runtimes gets whatever auth the embedder assembles for it, separately from the
authenticator and authorizer it hands core for every other method. Everything
a2agateway.New needs is already in scope in Start, so build it there and drop the
field.

Existing deployments are unaffected. build-controller builds controller-v2, which
sets A2AHandler on grpcserver.Config directly and never reads ExtensionConfig,
and the config that drives the gateway — A2A_GATEWAY_URL and
controller.a2aGatewayUrl — is unchanged. Only embedders of app.Start need a code
change.

Breaking changes

• ExtensionConfig.A2AHandler removed — core builds the handler from the
  authenticator and authorizer embedders already supply.
• -a2a-base-url → -a2a-gateway-url — different endpoints. a2a-base-url named
  the HTTP server on :8083 and has been dead config since chore: remove legacy ACP and controller runtime #2565; the gateway URL is
  published in agent cards as the agent's gRPC interface and must address :8084.
  The new flag matches the A2A_GATEWAY_URL env var and controller.a2aGatewayUrl
  chart value already in use, so deployments need no change.
• -substrate-atenet-router-url defaults to DefaultAtenetRouterURL instead of
  "", which never meant "substrate absent". NewRuntimeDialer rejects an empty value
  at startup.

A stale A2A_BASE_URL env var is silently ignored, but a stale -a2a-base-url
argument is a hard startup failure, since flag rejects unknown flags. The chart
configures by env, not args.

Testing

go build, go vet, go test clean. Chart suite 268/272 — the 4 failures are
kagent-tools subchart tests that fail identically on a clean checkout. Verified end to
end in kind with Substrate against a downstream embedder of app.Start:
CreateAgentInstance, SendMessage, DeleteAgentInstance all OK, agent reached
through the gateway and atenet router, no auth errors.

🤖 Generated with Claude Code