A2A executor returns raw exception details to remote peers #7445

Describe the bug

When an A2A agent execution fails, the Python executor places the raw exception text into the peer-visible failed-task response. A remote peer that can invoke the endpoint can therefore receive server-side details such as absolute paths, internal hostnames, ports, configuration-key names, or upstream error text.

This is a request/response confidentiality problem: the peer does not need the throwable text to handle a failed task.

Steps to reproduce

1. Expose an agent via the documented A2A server path.
2. Cause a normal server-side failure during execution (for example, a missing configured file or an unavailable internal dependency).
3. Send an ordinary A2A request from a separate client.
4. Inspect the final failed-task response.

The current failure handling serializes the exception message into the response, rather than returning a fixed safe summary.

Expected behavior

The peer should receive a generic failure message and an opaque error identifier. Full exception details should be retained only in server logs.

Suggested fix

Port the existing ADK Java behavior: generate a short error ID, log the full throwable server-side under that ID, and return only a fixed failure summary plus the ID to the peer. Keep detailed peer-visible errors only as an explicit local-debug opt-in.

Reference implementation: adk-java commit a3df463, which replaces peer-visible exception text with a fixed message and opaque error ID.

Additional context

This is intentionally scoped to the Python A2A executor and does not claim code execution, credential theft, or access-token disclosure. It is a defense-in-depth fix for information exposure across the A2A trust boundary.