[Epic] Push-notification config — security & semantics

## Push-notification config — security & semantics

### Problem

Several distinct gaps cluster around `PushNotificationConfig` / `TaskPushNotificationConfig`: secrets are returned on read, the `token` field's type is undefined, and the snapshot-on-registration semantics differ from `SubscribeToTask`.

### Consolidated issues

- [ ] #1681 — **Security:** `GetTaskPushNotificationConfig` / `ListTaskPushNotificationConfigs` return sensitive credentials *(anchor)*
- [ ] #1250 — Clarify the type/format of the `token` field (e.g. reference RFC 6750 Bearer)
- [ ] #1483 — Should push deliver a task snapshot as the first event on registration, matching `SubscribeToTask`?

### Acceptance criteria

- Read operations (`Get`/`List`) MUST redact or omit secret material; spec states this normatively.
- `token` field type/format is specified (or explicitly declared opaque) with a normative reference.
- Snapshot-on-registration behavior is defined for parity with subscribe (prevents the `GetTask`→`Subscribe` information gap).
- `a2a.proto`, spec text, and all bindings agree.