fix(client): normalize malformed agent card parsing errors

[kokotatan]

Description

When an agent-card endpoint returns HTTP 200 with valid JSON such as null, an array, a string, a number, or a boolean, the compatibility helpers raise AttributeError or TypeError. Malformed nested legacy fields can raise the same exceptions even when the root is an object. These exceptions escape A2ACardResolver.get_agent_card() instead of the documented AgentCardResolutionError.

Validate that the decoded value is a JSON object at the parser boundary. Convert TypeError and AttributeError from the three compatibility helpers into ParseError, retaining their original cause. The resolver already wraps ParseError into AgentCardResolutionError; protobuf parsing and signature verification retain their existing exception handling.

Regression tests use httpx.MockTransport with real JSON decoding: eight non-object roots and all six malformed nested cases from the review (null/list capabilities, a null additional interface, null skills/a null skill, and string security). Every new case failed before its corresponding fix. The nested-field tests also verify the full exception cause chain.

Validation

• The Windows equivalents of scripts/lint.sh (uv run --locked ruff check --fix, ruff format, and ty check) passed. ty exits successfully with three existing unused-ignore warnings.
• uv run --locked pytest tests/client/test_card_resolver.py -q: 46 passed.
• uv run --locked pytest --ignore=tests/integration --cov=src --cov-report=term-missing -q: 1,788 passed, 169 skipped, 3 xfailed; 91% coverage. card_resolver.py has 100% statement and branch coverage.
• With PYTHONIOENCODING=utf-8, sample integration smoke tests: 3 passed.
• Full pytest was attempted on Windows and timed out in scenario integration tests. A coverage run excluding only the scenario and sample modules completed with 2,095 passed, 183 skipped, 3 xfailed and 8 fixture errors; 93% coverage. The errors are in the previously problematic cross-version server fixtures (startup / unavailable os.killpg) and push-notification fixtures (a FastAPI local callable cannot be pickled under Windows multiprocessing). These platform limitations are outside this change.
• Updated GitHub Actions checks all passed, including the full Python 3.10–3.14 matrix, ACTS, ITK, lint and install checks. The same matrix also passed before this follow-up.

AI assistance: OpenAI Codex (GPT-6) was used to implement, reproduce, and test this change under the account owner's explicit authorization. The follow-up implements the human maintainer's review request and received another independent review before submission.

• Followed the contributing guide and conventional-commit title format.
• Added failing regression cases and ran lint, formatting, type and coverage checks.

[github-actions]

🧪 Code Coverage (vs main)

⬇️ Download Full Report

No coverage changes.

Generated by coverage-comment.yml

[mykytanetipa]

Checking isinstance(agent_card_data, dict) catches non-object root responses, but the _handle_*_compatibility helpers below still raise uncaught AttributeError/TypeError when nested fields have wrong types:

• {"supportsAuthenticatedExtendedCard": true, "capabilities": null} (TypeError on 'extendedAgentCard' not in capabilities)
• {"supportsAuthenticatedExtendedCard": true, "capabilities": []} (TypeError on item assignment)
• {"url": "https://example.com", "additionalInterfaces": [null]} (AttributeError on iface.get)
• {"skills": null} or {"skills": [null]} (TypeError / AttributeError)
• {"security": "invalid"} (AttributeError on sec_dict.items())

Could we catch (TypeError, AttributeError) in parse_agent_card and raise ParseError(...) from e (or explicitly raise ParseError for invalid nested types in the compatibility helpers) and add a couple of test cases for malformed nested fields?

[kokotatan]

@mykytanetipa Thanks for the review. fdd70db wraps the _handle_*_compatibility calls so a TypeError/AttributeError from a malformed nested field becomes a ParseError (and then AgentCardResolutionError, same chain as the non-object case). The cases you listed are covered by the new parametrized test_get_agent_card_malformed_nested_fields, which also checks the original exception is kept as __cause__. Could you take another look when you have time?

[mykytanetipa]

LGTM