bug: bearer A2A tasks/get reads any execution on an agent the principal can access, not only the tasks it started #3751

Summary

A bearer caller's tasks/get on the inbound A2A server scopes only on the agent (routers/a2a.py, the tasks/get branch): any Trinity principal with access to the agent can read any execution id on that agent, including turns another principal started. AAuth callers are gated by execution_owned_by; paid callers by the payer binding; bearer callers are not gated by who started the task.

Context

Pre-existing, recorded as a deferred item in the #3749 plan (decision 22) and left outside that fix's acceptance criteria because narrowing the read scope is a behaviour change for existing bearer clients. With #3749 merged, long turns now hand out execution ids more often, so the read scope is worth closing on its own.

Acceptance Criteria

• A bearer tasks/get / tasks/cancel answers Task not found for an execution the calling principal did not start on that agent (owner, shared user and admin reach stays as the principal's access to the agent dictates; document the rule).
• The existing bearer poll path for the starting principal is unchanged.
• Unit tests cover both directions; docs/user-docs/integrations/a2a-protocol.md states who may poll a task.

Technical Notes

• routers/a2a.py — the bearer tasks/get / tasks/cancel branches; the execution row already carries source_user_id / source_mcp_key_id, which is the natural ownership key.