Docs: spec + new A2A AgentCards guide for v0.3.0 surface

[jaschadub]

Summary

Documentation catch-up for the v0.3.0 release — the protocol spec and the published docs were still describing only the v0.2.0 surface. This PR brings both in line with what's actually shipping on crates.io / npm / PyPI / Go.

No code paths change. No SDK version bumps. v0.3.0 packages on the registries are unaffected.

Spec changes (AGENTPIN_TECHNICAL_SPECIFICATION.md)

• Header bumped 0.2.0 → 0.3.0 with a top-of-document summary of v0.3 additions. The wire-protocol agentpin_version field on documents stays at "0.1" — all v0.3 additions are additive and v0.2 callers ignore them.
• §4.8.3 DNS TXT: rewritten from the "Reserved for future specification" stub into the full normative spec (wire format v=agentpin1; kid=...; fp=sha256:<hex>, multi-key match rules, fail-closed semantics, parsing tolerance, MUST/SHOULD conformance language).
• §4.8.4 LocalAgentCardStore + §4.8.5 A2aAgentCardResolver: two new entries in Alternative Discovery Mechanisms. The A2A resolver includes the agentpin_endpoint host / fetched-domain cross-check.
• §4.8.7 Resolver Chain: renumbered, with chain order recommendation extended to include the two new resolvers.
• §4.9 Cross-Protocol Endpoint Fields: documents schemapin_endpoint + the new a2a_endpoint field; specifies the host/entity cross-check for a2a_endpoint.
• §4.10 A2A AgentCard Extension (new section): minimal AgentCard subset, AgentpinExtension payload, sorted-key canonical signing input (compact JSON, extension cleared, null-fields dropped, UTF-8), the verification chain (extension-signature + key-thumbprint match against the discovery document), capability→skill mapping, worked example.
• §4.11 AllowedDomains Typed Wrapper (new section): formalises the empty-list-equals-unrestricted convention, the six required operations, the SchemaPin v1.4 A2aVerificationContext composition pattern, and the documented intersection-becomes-empty edge case.
• §17 Conformance: adds MAY clauses for DNS TXT cross-verification and AgentCard acceptance; adds SHOULDs for the a2a_endpoint host cross-check and for using the AllowedDomains intersection helper at cross-protocol boundaries.
• §18 Future Work: removed item 9 (DNS TXT — now shipped); renumbered the rest; added a v0.4 mutual-auth-as-A2A-handshake target.
• Appendix A: a2a_endpoint field added to the Discovery Document JSON Schema.

New docs page

• docs/a2a-agentcards.md (208 lines): user-facing guide. When to use AgentCards, what the signed extension looks like, BuildAndSign + verifyAgentpinExtension snippets in all four SDKs (Rust / JS / Python / Go), the LocalAgentCardStore vs A2aAgentCardResolver decision tree, recommended ChainResolver ordering, capability→skill mapping, the allowed_domains cross-protocol scoping story, and the byte-identical cross-language interop guarantee.

Test plan

This is a docs-only PR; no test execution required. The pre-PR sanity check was:

• No conflict markers anywhere
• Section-numbering collisions resolved (the existing §4.8.5 Resolver Chain → §4.8.7 to make room for the two new resolvers)
• All §4.8.X cross-references in the new text point at the correct (post-renumber) sections
• TOC entries match the section anchors