docs: update CHANGELOG and A2A API docs for recent merged PRs

Add CHANGELOG [Unreleased] entries for 6 recently merged commits:
- feat(tui): shell danger detection patterns (#1003)
- fix(a2a): JSON-RPC 2.0 wire format compliance — BREAKING field rename (#1501)
- fix(cli): disallow mixing legacy and v3 plan workflows (#1577)
- fix(cli): actor add rich output missing panels
- fix(infra): E2E suite centralized database initialization (#1023)
- ci(pipeline): parallelized static analysis jobs

Update docs/api/a2a.md to reflect JSON-RPC 2.0 field name changes:
A2aRequest.operation → method, A2aResponse.data → result, etc.

CHANGELOG.md

@@ -7,6 +7,55 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Added
 
+- **TUI — Shell danger detection**: The TUI shell mode (`!` prefix) now detects
+  dangerous command patterns before execution. A configurable pattern registry
+  classifies commands by danger level (warning, critical) and surfaces a user
+  warning overlay before proceeding. Patterns cover destructive filesystem
+  operations, privilege escalation, network exfiltration, and more. (#1003)
+
+### Changed
+
+- **A2A — JSON-RPC 2.0 wire format compliance** (**BREAKING**): `A2aRequest`
+  and `A2aResponse` Pydantic models have been rewritten to use standard
+  JSON-RPC 2.0 field names. Callers constructing `A2aRequest` or reading
+  `A2aResponse` must update field references:
+
+  | Old field | New field | Model |
+  |-----------|-----------|-------|
+  | `a2a_version` | `jsonrpc` (fixed `"2.0"`) | both |
+  | `request_id` | `id` | both |
+  | `operation` | `method` | `A2aRequest` |
+  | `status` + `data` | `result` (success) | `A2aResponse` |
+  | `error` | `error` (unchanged) | `A2aResponse` |
+  | `timing_ms` | *(removed)* | `A2aResponse` |
+  | `auth` | *(removed — use `params` or HTTP headers)* | `A2aRequest` |
+
+  A `_result_xor_error` model validator enforces JSON-RPC 2.0 mutual exclusion
+  of `result` and `error`. (#1501)
+
+- **CLI — Legacy/v3 plan workflow mixing disallowed**: `agents plan` commands
+  now detect and reject attempts to mix legacy plan commands with v3 plan
+  workflows in the same session, surfacing a clear error message with migration
+  guidance. (#1577)
+
+### Fixed
+
+- **CLI — `agents actor add` rich output**: The `actor add` command now renders
+  the full spec-required output including **Type**, **Config**, **Capabilities**,
+  and **Tools** panels, matching the output format of `actor show`.
+
+- **Infra — E2E suite database initialization**: The common E2E Robot Framework
+  suite setup now centrally initializes the database before any CLI commands
+  run, eliminating per-suite and per-test `agents init` workarounds. Suite home
+  directory names are sanitized to prevent path-derived initialization failures
+  in isolated Robot runs. (#1023)
+
+- **CI — Parallelized static analysis pipeline**: Lint, typecheck, security
+  scan, and code quality jobs now run in parallel in the CI pipeline, reducing
+  total pipeline time for static analysis stages.
+
+### Added
+
 - **TUI — First-run experience with actor selection overlay**: On first launch
   (no personas configured), a centred `ActorSelectionOverlay` widget guides the
   user to select an actor from a curated list (`anthropic/claude-4-sonnet`,

docs/api/a2a.md

@@ -40,7 +40,7 @@ from cleveragents.a2a import A2aLocalFacade, A2aRequest
 
 facade = A2aLocalFacade(container)
 response = await facade.dispatch(
-    A2aRequest(operation="session.create", params={"actor": "openai/gpt-4o"})
+    A2aRequest(method="session.create", params={"actor": "openai/gpt-4o"})
 )
 ```
 
@@ -48,16 +48,38 @@ response = await facade.dispatch(
 
 ### `A2aRequest` / `A2aResponse`
 
+> **Breaking change (v3.7.0+):** Fields were renamed to comply with the
+> [JSON-RPC 2.0](https://www.jsonrpc.org/specification) wire format.
+> See the [CHANGELOG](../../CHANGELOG.md) for the migration table.
+
 ```python
 class A2aRequest(BaseModel):
-    operation: str
+    jsonrpc: Literal["2.0"] = "2.0"   # was: a2a_version
+    id: str | None = None              # was: request_id
+    method: str                        # was: operation
     params: dict[str, Any] = {}
-    version: A2aVersion = A2aVersion.V1
 
 class A2aResponse(BaseModel):
-    success: bool
-    data: Any | None = None
+    jsonrpc: Literal["2.0"] = "2.0"   # was: a2a_version
+    id: str | None = None              # was: request_id
+    result: Any | None = None          # was: data (success path)
     error: A2aErrorDetail | None = None
+    # result and error are mutually exclusive (enforced by validator)
+```
+
+Usage example (updated for JSON-RPC 2.0 field names):
+
+```python
+from cleveragents.a2a import A2aLocalFacade, A2aRequest
+
+facade = A2aLocalFacade(container)
+response = await facade.dispatch(
+    A2aRequest(method="session.create", params={"actor": "openai/gpt-4o"})
+)
+if response.result is not None:
+    session_id = response.result["session_id"]
+elif response.error is not None:
+    raise RuntimeError(response.error.message)
 ```
 
 ---