a2acli: Tier 1 conformance with the a2a-cli specification

## Summary

[`a2a-cli`](https://github.com/a2aproject/a2a-cli) (Go) defines a standardized, cross-language command-line contract for driving A2A agents: [`specification/SPEC.md`](https://github.com/a2aproject/a2a-cli/blob/main/specification/SPEC.md) (normative) and [`specification/COMPLIANCE.md`](https://github.com/a2aproject/a2a-cli/blob/main/specification/COMPLIANCE.md) (the requirement-identifier registry and acceptance checklist). `a2acli`, the CLI shipped from this repo (`a2acli/`), needs to conform to it.

A review of `a2acli/src/lib.rs` against `SPEC.md` v0.2 / `COMPLIANCE.md` (2026-08-17) found it currently satisfies **none of the 39 Tier 1 ("Core") requirements** cleanly — it's a thin JSON-only wrapper around `a2a-client` with a different command surface, no blocking/polling, and no human-readable output mode. This issue tracks bringing it to Tier 1.

## Why

Tier 1 is the baseline every `a2a-cli` implementation is meant to share (`SPEC.md` §5), so a script, CI job, or AI coding agent written against the spec's command surface behaves identically regardless of implementation language (§6.4). Today a script written against the standard surface (`a2a card get `, `a2a send --stream ...`, `a2a task get --wait`) does not run against `a2acli` at all — different command names, different flags, no blocking wait, JSON-only output.

## Scope

Tracked as 6 sub-issues, each an independent unit of work; each lists the exact `COMPLIANCE.md` §4 requirement IDs it closes.

- [ ] #165 — align command surface with the a2a-cli taxonomy
- [ ] #166 — blocking-by-default `send`, task polling, and message parts
- [ ] #167 — stateless interaction-id handling and resume hints
- [ ] #168 — `text` output mode, error envelope, and exit-code contract
- [ ] #169 — auth, transport selection, and version-negotiation flags
- [ ] #170 — overridable defaults, config precedence, and `config show`

## Requirement tally (Tier 1 — Core, 39 total)

| Area | IDs | Current status |
| --- | --- | --- |
| `CARD_GET` | `_001` | ◐ fetches card, but no `--extended`/ordered transport preference |
| `SEND` | `_001`–`_006` | ◐ sends text only; no blocking wait, no message parts |
| `TASK_GET` | `_001` | ◐ one-shot only, no `--wait` |
| `TASK_CANCEL` | `_001` | ◐ cancels, but no text-mode reporting |
| `INTERACT` | `_001`–`_005` | ◐ ids pass through, but no resume-hint printing |
| `TASK_POLL` | `_001`–`_004` | ❌ no polling implementation at all |
| `OUT` | `_001`–`_006` | ❌ JSON-only, no error envelope |
| `EXIT` | `_001`–`_002` | ❌ all failures exit `1` uniformly |
| `AUTH` | `_001`–`_004` | ◐ bearer + custom headers only |
| `TX` | `_001`–`_003` | ◐ single-binding preference, not ordered/repeatable |
| `VER` | `_001` | ✅ `A2A-Version` sent automatically by `a2a-client` |
| `DEFAULT` | `_001` | ❌ several baseline defaults missing (wait, text, TLS warning) |
| `CONFIG` | `_001` | ❌ no persisted configuration at all |
| `CLI` | `_001` | ◐ `--help`/`--version` via clap; no effective-defaults display |
| `SKILL` | `_001`–`_002` | — N/A, ships no Agent Skill |

## Non-goals (this tracking issue)

- Tier 2 / Tier 3 requirements (`task list`/`subscribe`/`push-config` UX polish, `auth login`, gRPC, `chat`, catalog resolution, push-notification receiver, etc.) — worth a follow-up once Tier 1 lands.
- The crates.io package name (`a2a-cli`) stays; only the *installed binary name* is in scope of the command-surface work below.

## References

- Spec: https://github.com/a2aproject/a2a-cli/blob/main/specification/SPEC.md
- Compliance registry: https://github.com/a2aproject/a2a-cli/blob/main/specification/COMPLIANCE.md
- Go reference implementation's command reference: https://github.com/a2aproject/a2a-cli/blob/main/internal/README.md