feat(demo): add Agent-to-Agent binding walkthrough

[thinksyncs]

Summary

• Add a one-command Agent A to Agent B binding demonstration.

Changes

• Run real localhost mTLS 1.3 communication with live TLS exporter and request-context binding.
• Verify Manager and Agent signatures, receiver-local L3-L6 policy, application resource mapping, and replay protection.
• Demonstrate one accepted task and fail-closed rejection of scope escalation, resource substitution, wrong audience, session borrowing, and replay.
• Document go run ./examples/a2a.

Testing

• go run ./examples/a2a
• go test -race -count=1 ./examples/a2a
• go vet ./examples/a2a
• go test -count=1 ./...
• make product-security-gate

Notes

• This is a software-only, single-process localhost demonstration. It does not perform hardware attestation or define an application-protocol message format.

[Copilot]

Pull request overview

Adds a runnable Agent-to-Agent (A→B) localhost demo showcasing the project’s secure binding flow (mTLS 1.3 + TLS exporter + request-context binding) and several fail-closed rejection scenarios, alongside a Makefile target and README docs to make the walkthrough easy to run.

Changes:

• Documented a new make demo-a2a walkthrough in README.md.
• Added a demo-a2a Makefile target to run the new example.
• Introduced examples/a2a demo implementation plus a smoke test validating expected outputs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
README.md	Documents the new Agent-to-Agent demo entrypoint and what it demonstrates.
Makefile	Adds demo-a2a phony target to run the example with the selected Go toolchain.
examples/a2a/main.go	Implements the end-to-end localhost mTLS demo with grant + session binding verification and replay checks.
examples/a2a/main_test.go	Adds a test that runs the demo and asserts expected scenario outputs are present.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.