Fix: Bump google.golang.org/grpc to 1.82.1 in cross-language Go test backend

[AmaadMartin]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):
   N/A — Dependabot security alert, no public issue.

2. Or, if no issue exists, describe the change:

Problem: The Go test backend at tests/cross_language/a2a/ts_go/go_backend/go.mod pins google.golang.org/grpc at v1.79.3. That version is inside the vulnerable range of GHSA-hrxh-6v49-42gf (HIGH, "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", vulnerable < 1.82.1, first patched 1.82.1). The alert is in a Go module, not in the npm tree. The sibling module tests/cross_language/a2a/go_ts/go_client already runs 1.82.1 after google#530, so the two Go test modules are out of lockstep.

Solution: I ran go get google.golang.org/grpc@v1.82.1 && go mod tidy in go_backend. This produces a six-line change to the indirect require block. I used the pinned @v1.82.1 form rather than go get -u, because -u also upgrades every transitive dependency and makes the diff unreviewable. The otel and genproto moves are transitive consequences of the grpc requirement; the same set already landed on the sibling module.

Module	Before	After
google.golang.org/grpc	v1.79.3	v1.82.1
google.golang.org/genproto/googleapis/api	v0.0.0-20260128011058-8636f8732409	v0.0.0-20260414002931-afd174a4e478
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260128011058-8636f8732409	v0.0.0-20260414002931-afd174a4e478
go.opentelemetry.io/otel	v1.41.0	v1.43.0
go.opentelemetry.io/otel/metric	v1.41.0	v1.43.0
go.opentelemetry.io/otel/trace	v1.41.0	v1.43.0

All six stay // indirect. The module never imports grpc directly, so no API surface changes. The go 1.25.0 directive is unchanged and no toolchain line was added. go.sum is git-ignored, so the pull request contains exactly one file.

Collision check: I scanned all 582 open pull requests on the fork and the open pull requests upstream. No other pull request touches go_backend/go.mod. Four adjacent branches (#648, #427, #393, #306) change only .github/workflows/cross-language-integration.yml, and #629 changes only the vitest project config.

Testing Plan

Please describe the tests that you ran to verify your changes. This is required for all PRs that are not small documentation or typo fixes.

Unit Tests:
[x] N/A — this change adds no executable line of Go or TypeScript. A test that asserts on the contents of go.mod would be a change-detector test.
[x] All unit tests pass locally. (See the cross-language run below.)

Proof the verification is load-bearing. A dependency bump has no test to mutate, so I checked the resolved build graph instead of the file text. With the previous go.mod restored, go list -m google.golang.org/grpc reports v1.79.3. With this change, it reports v1.82.1:

AFTER:    google.golang.org/grpc v1.82.1
BEFORE:   google.golang.org/grpc v1.79.3
RESTORED: google.golang.org/grpc v1.82.1

Cross-language suite (npm ci && npm run build, then):

$ npx vitest run --project cross-language
 ✓ |cross-language| tests/cross_language/a2a/ts_go/ts_a2a_go_test.ts (2 tests) 804ms
 ✓ |cross-language| tests/cross_language/a2a/go_ts/go_a2a_ts_test.ts (2 tests) 5486ms
 Test Files  2 passed (2)
      Tests  4 passed (4)

Manual End-to-End (E2E) Tests:

From tests/cross_language/a2a/ts_go/go_backend:

$ md5sum go.mod > /tmp/before.md5 && go mod tidy && md5sum -c /tmp/before.md5
go.mod: OK                     # tidy-stable, byte-identical

$ go build ./...               # exit 0
$ go vet ./...                 # exit 0

$ PORT=18711 go run .
Starting Go server...
A2A Server started on http://127.0.0.1:18711

# in another shell:
$ curl -s -o /dev/null -w '%{http_code}\n' \
    http://127.0.0.1:18711/a2a/basic_agent/.well-known/agent-card.json
200

The agent card returned {"capabilities":{"streaming":true},...,"name":"go_test_agent",...}. The backend needs no API key: basic_agent.go uses an in-process mock model.

After the bump, the indirect require block of go_backend/go.mod differs from go_client/go.mod by one entry only — github.com/a2aproject/a2a-go, which is a direct require in go_backend.

Checklist

[x] I have read the CONTRIBUTING.md document.
[x] I have performed a self-review of my own code.
[x] I have commented my code, particularly in hard-to-understand areas.
[ ] I have added tests that prove my fix is effective or that my feature works. — N/A, no new code. The existing cross-language suite exercises the bumped module.
[x] New and existing unit tests pass locally with my changes.