feat(a2a): streaming TaskProcessor routed through full agent loop

[bug-ops]

Parent

Part of #581. Depends on LoopbackChannel issue.

Summary

Refactor TaskProcessor trait to support streaming and rewrite AgentTaskProcessor to route A2A requests through the full agent loop (skills, memory, tools, MCP) instead of direct provider.chat().

Scope

Files: crates/zeph-a2a/src/server/handlers.rs, crates/zeph-a2a/src/server/mod.rs, src/main.rs

TaskProcessor trait change

// Current
async fn process(&self, task_id: &str, message: Message) -> Result<ProcessResult>;

// New
async fn process(&self, task_id: &str, message: Message, event_tx: Sender<TaskEvent>) -> Result<()>;

Processor emits events via event_tx:

• TaskArtifactUpdateEvent { is_final: false } per token chunk
• TaskStatusUpdateEvent { state: Working } on status changes
• TaskStatusUpdateEvent { state: Completed, is_final: true } on completion

SSE handler update

Pipe event_tx → SSE stream directly. Remove current "process() then emit status" pattern.

AgentTaskProcessor rewrite

• Holds LoopbackHandle from LoopbackChannel
• process(): sends user text via input_tx, reads LoopbackEvents from output_rx
• Maps: Chunk → ArtifactUpdate, Flush → StatusUpdate(Completed), Status → StatusUpdate(Working)

Acceptance Criteria

• A2A message/send returns agent response with skills/memory/tools active (not bare LLM)
• A2A message/stream emits per-token ArtifactUpdate SSE events
• Existing A2A tests updated for new trait signature

[bug-ops]

Update (2026-02-20): alignment with recent refactors

• PR refactor: replace anyhow with typed errors in library crates #676 replaced anyhow with typed errors — AgentTaskProcessor must use A2aError variants (already in zeph-a2a), not anyhow::Result
• TaskProcessor trait lives in crates/zeph-a2a/src/server/state.rs — the streaming signature change must return Result<(), A2aError>
• PR feat(security): mitigate SSRF and information leakage #672 SSRF hardening — AgentTaskProcessor is server-side only, no SSRF implications; but localhost bypass API (with_security) referenced in feat(tui): --connect mode to attach TUI to remote daemon via A2A SSE #585 is confirmed available