feat(examples): enable ValidationHookConfig at boot in v3 reference seller

[bokelley]

Closes #387

Summary

• Threads validation: ValidationHookConfig | None = None through adcp.server.serve(), create_mcp_server(), create_a2a_server(), and ADCPAgentExecutor.__init__ — previously the A2A executor silently ignored any validation config passed via serve(transport="both", ...), so strict mode had no effect on the A2A leg of the reference seller.
• The v3 reference seller now boots with ValidationHookConfig(requests="strict", responses="strict") by default and drops to warn when ADCP_ENV=production, reusing the same convention _default_response_mode() already uses on the client side so both sides flip together.
• README documents the strict/warn trade-offs, env-var knob, and what a VALIDATION_ERROR rejection looks like on the wire.
• 5 new smoke tests: 3 unit tests for _build_validation_config() env-var behavior, 2 async tests confirming strict rejects malformed requests before the handler runs and warn mode processes them with a logged warning.

What was tested

• pytest tests/ --asyncio-mode=auto (excluding unrelated TLS hostname test): 3078 passed, 26 skipped
• pytest examples/v3_reference_seller/tests/test_smoke.py: 12 passed (7 pre-existing + 5 new)
• ruff check src/ examples/v3_reference_seller/src/: clean
• mypy src/adcp/server/serve.py src/adcp/server/a2a_server.py --ignore-missing-imports: no issues

Pre-PR review

• code-reviewer (initial consultation): confirmed non-breaking threading; flagged A2A silent-drop as blocker → fixed by threading validation= into ADCPAgentExecutor and create_a2a_server; flagged ADCP_ENV vs new env-var inconsistency → resolved by reading ADCP_ENV directly.
• dx-expert (diff review): mode: str → mode: ValidationMode removes # type: ignore[arg-type] → fixed; missing cfg.responses assertion in prod-alias test → fixed; README wire-format example → added.

Nits (not fixed — surfaced for reviewer awareness)

• Response-side strict errors do not include a field pointer in the raised ADCPTaskError the way request-side errors do. This is pre-existing asymmetry in create_tool_caller; not in scope here.
• _build_validation_config() collapses requests+responses to a single mode. The ValidationHookConfig dataclass supports independent control; adopters who need independent knobs can call ValidationHookConfig(requests=..., responses=...) directly.

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See adcp#3121
for context.

Session: https://claude.ai/code/cse_01L78kF12Kbmf1QvBCuN5k5W

---

Generated by Claude Code