fix: propagate trace context end-to-end for agent Services

[syn-zhu]

Summary

Three fixes to enable end-to-end W3C TraceContext propagation across the controller→agent boundary:

1. AppProtocol on agent Services — Set appProtocol: kgateway.dev/a2a on the Service port created for each Agent CR so AgentGateway's A2A plugin can discover agent Services directly via protocol matching, rather than proxying through the kagent controller (which drops HTTP headers including traceparent).

2. W3C TraceContext propagator in Python SDK — Configure the W3C TraceContext propagator in kagent-core tracing setup so agent pods correctly extract incoming traceparent headers and propagate them on outgoing requests.

3. Trace header propagation in Go controller — The A2A server deserializes incoming HTTP requests into JSON-RPC params, discarding the original HTTP headers. When the controller forwards requests to agent pods via the A2A client, traceparent/tracestate are lost. Fix: capture W3C trace context headers from the incoming request into the Go context in the A2A auth middleware (A2AAuthenticator.Wrap), then inject them into outgoing requests in A2ARequestHandler.

All golden test outputs have been updated to include the new appProtocol field, including agent_with_passthrough (added in #1327).

Incorporates changes from opspawn@d9f2a3a.

Test plan

• Golden tests updated and passing — all testdata/outputs/*.json files include appProtocol: "kgateway.dev/a2a" on Service ports
• go test ./internal/httpserver/auth/... passes
• Deploy agent, verify kubectl get svc <agent> -o jsonpath='{.spec.ports[0].appProtocol}' returns kgateway.dev/a2a
• Verify AgentGateway A2A plugin discovers the Service
• Send request with traceparent header through gateway → controller → agent pod, verify trace ID is preserved end-to-end

Closes #1295

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the Agent manifest translation so that the Kubernetes Service created for each Agent CR sets an explicit appProtocol, enabling AgentGateway’s A2A plugin to discover and route directly to agent Services (preserving HTTP headers for distributed tracing).

Changes:

• Set spec.ports[0].appProtocol: kgateway.dev/a2a on the per-Agent Service port.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[EItanya]

Hey there, thanks for the PR, this is a great idea! You will need to update the goldens as well as sign your commits for us to merge this

[syn-zhu]

Hey there, thanks for the PR, this is a great idea! You will need to update the goldens as well as sign your commits for us to merge this

Thanks! Just saw this now, but it looks like the issue was already fixed by opspawn@d9f2a3a :)

Gonna just close this PR, thanks!

[syn-zhu]

Oops @EItanya i realized the commit I linked wasn't actually a merged commit, but rather a branch. I've updated and reopened my PR to address the things you mentioned. Please lmk if there's anything else!

[krisztianfekete]

Hi @syn-zhu, Could you please test this locally on your end first? As it's Claude-generated code, a brief manual validation, e.g. such as posting before/after screenshots from a tracing tool would be the minimum step to ensure it's ready for contribution.