fix(a2a): do not cache remote agent card when validation fails

[Ashfaqbs]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

• Closes: RemoteA2aAgent caches an invalid Agent Card after RPC URL validation failure #6901

Problem:
RemoteA2aAgent._ensure_resolved() (shared/cached resolution path) assigned self._agent_card = await self._resolve_agent_card(ctx) before calling await self._validate_agent_card(self._agent_card). When validation raises (e.g. an RPC URL that fails the https/loopback check), the invalid card is already cached on self._agent_card. The next invocation's if not self._agent_card: guard then evaluates to False, so resolution and validation are both skipped entirely and the previously-rejected, unvalidated card is reused to build the A2A client — the exact bypass described in #6901.

Solution:
Hold the resolved card in a local variable, validate it, and only assign it to self._agent_card after validation succeeds. A failed validation now leaves self._agent_card as None, so the next call re-resolves and re-validates instead of reusing the rejected card.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

Added test_ensure_resolved_does_not_cache_card_on_validation_failure in tests/unittests/agents/test_remote_a2a_agent.py, asserting self._agent_card stays None after a validation failure and that the next call re-resolves + re-validates (rather than reusing a cached invalid card) and succeeds once validation passes.

$ pytest tests/unittests/agents/test_remote_a2a_agent.py -q
230 passed, 294 warnings in 10.46s

Note: I tested against the commit just before 85b52f6a (chore(live): create top-level google.adk.live package...), since that commit's diff appears to be missing the actual src/google/adk/live/ package it references (only the tests under tests/unittests/live/ landed), which currently breaks import google.adk on main. That's unrelated to this change — flagging separately rather than bundling here.

Manual End-to-End (E2E) Tests:

Not run — this is a pure caching-order bug, fully exercised by the unit test above (mocks _validate_agent_card to raise on the first call, succeed on the second, and asserts the card is neither cached nor reused across the failure).

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.

[Ashfaqbs]

Closing this — I see 2685acd landed the same fix internally around the same time, so this is superseded. Nothing to reconcile, just closing out the duplicate.

Thanks for maintaining this project — happy to keep contributing if there's anything in the backlog worth picking up.