fix(adk): preserve A2A user identity before task resolution - #11

Summary

Preserve the initiating A2A user identity in the context returned by the Go runtime call interceptor, so pre-executor task-store callbacks observe the same authenticated user as CallContext.User.

Problem

UserIDCallInterceptor.Before already reads x-user-id from the authenticated A2A request and assigns it to CallContext.User, but it returned the original context unchanged.

Task resolution can occur before KAgentExecutor.Execute adds identity to the invocation context. Pre-executor TaskStore.Get and TaskStore.Save callbacks that read identity from context.Context could therefore fall back to the runtime service identity. This breaks owner-scoped access when a persisted continuation arrives in a later request or process.

Change

userIDInterceptor.Before now returns auth.WithUserID(ctx, userID) after populating CallContext.User. Both identity access paths therefore carry the same authenticated user before stored-task resolution begins.

Trust boundary

This does not add a new identity source or broaden trust in caller-controlled metadata. The interceptor already accepts the authenticated service parameter and exposes it as CallContext.User; this change makes the returned Go context consistent with that existing call identity.

Contract protected

A persisted A2A continuation is a new request. Runtime task callbacks must reconstruct the authenticated owner on every request rather than relying on executor-local state from the original invocation.

The regression test protects both CallContext.User and auth.UserIDFromContext(returnedContext). This server-side contract remains relevant even when an in-repository UI does not exercise cross-process A2A continuation.

Scope and companion seams

This PR changes only the Go ADK runtime context lifecycle. It does not:

• forward the controller's effective user on the legacy controller-to-runtime hop, tracked in kagent-dev/kagent#2467;
• implement persistent exact A2A GetTask, tracked in kagent-dev/kagent#2464; or
• change the Python runtime.

The controller forwarding and runtime context changes are independently testable but complementary for Go-runtime persisted resume.

Changed files

• go/adk/pkg/a2a/executor.go
• go/adk/pkg/a2a/executor_test.go

Tests

• cd go && go test ./adk/pkg/a2a -run '^TestUserIDCallInterceptor$' -count=1 — passed
• cd go && go test ./adk/pkg/a2a — passed

Validation status

The Go-specific behavior is directly covered by the interceptor regression test. Combined controller-route validation performed with a Python declarative runtime is intentionally not presented as live proof of this Go-only change.

Intended upstream issue: kagent-dev/kagent#2465.