fix(a2a): enforce IBCT capability tokens on client and server request paths

[bug-ops]

Summary

• zeph-a2a's IBCT (Invocation-Bound Capability Token) primitive was fully implemented and unit-tested in isolation, but never wired into the live A2A request path (CWE-862 Missing Authorization). Config documented it as an active per-task authorization layer on top of the coarse bearer token; it wasn't.
• Server: new ibct_middleware layered inside auth_middleware rejects /a2a//a2a/stream with 401 (missing/undecodable header) or 403 (signature/expiry/scope mismatch) whenever A2aServer::with_ibct_keys is configured with a non-empty key set; no-op when unconfigured (matches the existing bearer-auth opt-in pattern). src/daemon.rs resolves [a2a] ibct_keys / ibct_signing_key_vault_ref (vault-resolved, hard-fails startup if the ref is set but unresolvable, per the spec invariant).
• Client: A2aClient::with_ibct_key issues and attaches a token scoped to the request's task_id and to the target endpoint's origin (ibct_scope_origin strips the path, since /a2a and /a2a/stream are both verified against the one pathless AgentCard::url). The same normalization is applied server-side to card.url so a non-canonical public_url can't silently reintroduce the mismatch.
• Corrected the four doc surfaces (A2aServerConfig doc comments, crates/zeph-a2a/README.md, specs/014-a2a/spec.md, specs/010-security/spec.md) that overclaimed active enforcement, and added an explicit deployment caveat: no caller bundled in this repository currently attaches X-Zeph-IBCT, so this PR ships the enforcement primitive rather than a fully activated end-to-end control for the delegated-subagent scenario the issue describes.

Review history

Went through a full security chain (reduced: developer → impl-critic → reviewer, audit lead-in skipped since the issue already specified exact locations/remediation):

• impl-critic first pass found a structural defect (S1: endpoint-scope mismatch meant /a2a and /a2a/stream could never both pass) and that no production caller attaches the header (S2) — both addressed, re-verified as fixed.
• Code review found one more instance of the same bug class on the server side (M6: card.url wasn't normalized like the client's endpoint) plus missing mandatory testing-playbook/coverage-status entries — both addressed, re-reviewed and approved.

Test plan

• cargo nextest run -p zeph-a2a --features server,ibct,card-signing — 235/235 passed
• cargo nextest run -p zeph-a2a (ibct feature off) — 195/195 passed (backward compat)
• Full workspace check suite (fmt, clippy --profile ci, nextest, rustdoc gate) — all green, confirmed independently by reviewer
• gitleaks protect --staged — no leaks
• Regression tests for the endpoint-scope bug class on both client and server sides (pathful_endpoint_scope_is_rejected, origin_scoped_token_accepted_on_both_routes, non_canonical_card_url_still_matches_client_issued_token, ibct_scope_origin_strips_explicit_default_port)
• .local/testing/playbooks/a2a-ibct-enforcement.md and .local/testing/coverage-status.md updated (main repo)

Closes #6260