chore(main): release 2.4.0

[a2a-bot]

🤖 I have created a release beep boop

2.4.0 (2026-07-20)

Features

• provide generic pull event queue (#354) (6a48d4b)
• push: push sender SSRF protection enabled by default (fixes #373) (#374) (0a4f17a)

Bug Fixes

• a2acompat/a2av0: implement A2A v0.3 REST wire format (#371) (1ca80f9), closes #370
• a2asrv: skip TaskID mismatch check when message has no task reference (fixes #350) (#359) (8c0dd99)
• allow empty request bodies and enable GET method for task subscriptions (#381) (8363365), closes #380
• cli: emit non-null required Agent Card list fields in synthesized card (fixes #369) (#372) (0640869)
• eventqueue: add JSON marshal/unmarshal to Message so events survive roundtrip (fixes #349) (#360) (d52d5a1)
• itk grpc compatibility for v0.3 SDKs (#367) (11340a7)
• ListTaskshistoryLength missing (8b91364)
• ListTaskshistoryLength missing (issue #355) (#361) (8b91364)
• taskstore,push: enforce cross-tenant authorization on Get and push config stores (#357) (a9f9c64)

---

This PR was generated with Release Please. See documentation.

[gemini-code-assist]

Code Review

This pull request bumps the project version from 2.3.1 to 2.4.0 in the release manifest and updates the changelog to document the addition of a generic pull event queue feature. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.