chore(deps): upgrade google.golang.org/adk to v1.6.0

[aheritier]

Summary

Upgrade the direct dependency google.golang.org/adk from v1.2.0 to v1.6.0.

The upgrade has been assessed in a disposable copy of the repository. The project compiles and the A2A end-to-end paths pass at v1.6.0, but the upgrade introduces two Staticcheck deprecation failures because the currently used ADK A2A v0 compatibility package is deprecated.

Current usage and affected scope

google.golang.org/adk is declared directly in go.mod and is used only by the A2A server adapter:

• pkg/a2a/adapter.go — adk/agent, adk/model, and adk/session
• pkg/a2a/executor_wrapper.go — adk/server/adka2a
• pkg/a2a/server.go — adk/runner, adk/server/adka2a, and adk/session
• Tests: pkg/a2a/adapter_run_test.go, pkg/a2a/executor_wrapper_test.go, pkg/a2a/server_test.go, plus e2e/a2a_test.go

The direct github.com/a2aproject/a2a-go usage under pkg/tools/a2a/ is not itself an ADK integration, but it is in the relevant validation blast radius.

Findings

APIs currently used outside ADK A2A server support remain compatible

The method sets used from adk/agent, adk/session, adk/model, and adk/runner are unchanged for this repository between v1.2.0 and v1.6.0. model.LLMResponse has additive fields only; existing named-field construction and reads remain valid.

A2A compatibility package is deprecated

ADK v1.6.0 rewrites google.golang.org/adk/server/adka2a as a deprecated compatibility shim over google.golang.org/adk/server/adka2a/v2.

The existing adka2a API is source-compatible with docker-agent: ExecutorConfig, NewExecutor, and Executor.Execute(ctx, *a2asrv.RequestContext, eventqueue.Queue) error preserve the signatures used by pkg/a2a. However, task lint reports these new blockers:

pkg/a2a/executor_wrapper.go: SA1019: "google.golang.org/adk/server/adka2a" is deprecated: Use google.golang.org/adk/server/adka2a/v2 instead.
pkg/a2a/server.go: SA1019: "google.golang.org/adk/server/adka2a" is deprecated: Use google.golang.org/adk/server/adka2a/v2 instead.

A direct v2 migration is not a dependency-only change

adka2a/v2 uses github.com/a2aproject/a2a-go/v2 and a different executor contract: it takes *a2asrv.ExecutorContext and returns iter.Seq2[a2a.Event, error], rather than accepting a v0 RequestContext, writing to eventqueue.Queue, and returning an error. Migrating would require a deliberate rewrite of the local A2A HTTP/JSON-RPC wiring and the queue-based fixingQueue wrapper in pkg/a2a/executor_wrapper.go.

Keep that migration out of the version-bump PR; track it separately if desired.

Expected module graph changes

After go mod tidy, expect:

• google.golang.org/adk v1.2.0 → v1.6.0
• new indirect github.com/a2aproject/a2a-go/v2 v2.3.1
• indirect upgrades including go.opentelemetry.io/contrib/.../otelgrpc v0.63.0 → v0.67.0, google.golang.org/api v0.272.0 → v0.279.0, cloud.google.com/go/auth v0.18.2 → v0.20.0, github.com/googleapis/gax-go/v2 v2.18.0 → v2.22.0, and github.com/googleapis/enterprise-certificate-proxy v0.3.14 → v0.3.15.

The repository already pins compatible/higher versions of github.com/a2aproject/a2a-go v0 and google.golang.org/genai, so they should not change under MVS. The new A2A v2 dependency is Apache-2.0 and fits the existing CI license allow-list; no license exception should be required.

Proposed implementation

1. Bump ADK to v1.6.0 in go.mod and run go mod tidy.
2. Keep the existing adka2a v0 compatibility adapter for this dependency-only change.
3. Suppress the two intentional SA1019 findings narrowly, following the repository's established nolint convention, without hiding other staticcheck results. Prefer tracking the eventual v2 migration in a separate issue rather than coupling it to this upgrade.
4. Do not change config schema packages, agent-schema.json, or documentation; this is a Go dependency upgrade only.

Validation and acceptance criteria

• go build ./... passes.
• go vet ./... passes.
• task lint passes, including the CI go-licenses check path.
• task test passes.
• Focused A2A coverage passes, including TestA2AServer_AgentCard, TestA2AServer_Invoke, TestA2AServer_MultipleRequests, and TestA2AServer_MultiAgent in e2e/a2a_test.go.
• The only deprecation handling is scoped to the two existing adka2a imports; no broad staticcheck disable.
• No configuration schema or user-facing documentation changes are included.
• A follow-up v2-migration issue is created or linked if the team elects to remove the deprecated compatibility layer.

Risk and rollback

The primary runtime risk is ADK's internal conversion through its new A2A v2 compatibility layer. The focused A2A e2e suite exercises that path. If regression occurs, revert the isolated dependency-upgrade commit to restore v1.2.0 and its former module graph.