[A2A] D2b: Testcontainers E2E for A2A gateway (issue #5340 follow-up)

Part of #5296 (Architecture Review, Q4). Follow-up to #5340 / PR #5346 (D2a).

## What this issue tracks

D2a (PR #5346) landed the in-process A2A readiness checks:
- TaskExpirer reaper + unit test
- MetaAgentCardRegistry (cluster-shared) + unit test
- A2AGatewayService.createTask try/catch (future-based failure surfacing) + integration test
- docs/a2a-readiness-decision.md (keep A2A Experimental)

D2a pin the contract at the user-facing API. **D2b** is the Testcontainers-based end-to-end suite that exercises the same scenarios against a live Meta + broker + multi-instance EM deployment. D2b is the gate for promoting A2A from Experimental to Beta (per docs/a2a-readiness-decision.md).

## What needs to land

1. **A new module ** under the runtime test sources, gated on a Testcontainers profile (so the default test task stays fast and green).
2. **Container composition**:
- Nacos 2.x for the MetaStore (NacosMetaStore is the production wiring)
- One RocketMQ 5.x broker (or Kafka, depending on what the suite wants to exercise)
- 3 EventMesh Runtime instances sharing the Nacos Meta
3. **Test scenarios** (mirror D2a's in-process tests, but end-to-end):
- **Happy path**: A2A client on EM-1 submits a task to agent-A registered on EM-2; agent-A completes the task; client receives the response.
- **Failure mode**: kill the Nacos container mid-task-submit; the A2A gateway surfaces the failure to the client within a bounded timeout (not hung, not silently dropped).
- **Recovery**: restart Nacos; subsequent submits succeed.
- **Multi-instance fence**: two EM instances both believe they own agent-A; the Meta CAS + epoch fencing rejects the stale writer.
4. **CI**: a separate workflow that runs the suite on PRs that touch or . The suite must be green for at least one full release cycle before A2A can be promoted to Beta.

## Acceptance

- [ ] module exists and is built by Gradle.
- [ ] The four scenarios above pass in CI.
- [ ] workflow exists and is wired to the correct path filters.
- [ ] docs/a2a-protocol/README.md is updated with the post-D2b wire contract and SLOs.
- [ ] docs/a2a-readiness-decision.md is updated to record that A2A is promoted from Experimental to Beta.

## Depends on / Blocks

- Depends on: #5340 D2a (DONE, PR #5346)
- Blocks: closure of #5296 (Q4 must be answered with D2b green)

Read docs/a2a-readiness-decision.md and docs/a2a-protocol/README.md, then inspect the D2a implementation and tests from PR #5346. Define the Testcontainers module and profile around the four listed scenarios, add the path-filtered CI workflow, and update both documents when the suite passes and the wire contract and SLOs are recorded.

Written by the indexing model from the issue text.