chore(deps): bump a2a-sdk lock to 1.1.4

[Superagentic-AI]

Summary

• Lock a2a-sdk 1.1.2 → 1.1.4 (now on PyPI as of 2026-09-18). Spec pin stays >=1.1.2,<2.0.0.
• Includes upstream server/store fixes (idempotent sink removal, owner-scoped cancel/subscribe, push-notification URL validation / SSRF hardening, omit artifacts from list-tasks).
• Tiny docs/docstring alignment: serve uhp docstring → UHP 2026-09-12; a2a.md note says 1.1.x instead of hardcoding 1.1.2.

Ecosystem watch notes (not in this PR)

• UHP protocol 2026-09-12 already adopted in SuperQode (client + serve).
• ACP still pin <0.12 (0.12.1 / 1.0.0rc1 deliberate skip).
• FastMCP 4.0.5 / MCP 2.2.0 still skip; PR Bump fastmcp to 3.4.7 (stay on MCP v1 line) #13 (fastmcp 3.4.7) left open, now CONFLICTING.
• HarnessRouter CE at v0.22.0 (System One / TypeSafe provider); UHP client already discovers server harnesses, no SuperQode code change.

Test plan

• CI green on this branch
• Optional local: uv sync --extra a2a then uv run python -c "import a2a; print(a2a.__version__ if hasattr(a2a,'__version__') else 'ok')"

[Superagentic-AI]

Superseded by the 1.1.5 bump in a follow-up PR (a2a-sdk 1.1.5 landed on PyPI after this branch, and this tip was behind main). Please close in favor of the new PR.

[Superagentic-AI]

Superseded by #36 (a2a-sdk lock 1.1.5 + protobuf 7 / Antigravity conflict cleanup). Closing as obsolete; no further review needed.