feat: add iii-mcp and iii-a2a protocol workers

[rohitg00]

Summary

Two standalone protocol workers under workers/. Each is its own crate with its own binary. No shared library.

• iii-mcp — MCP protocol worker (stdio + Streamable HTTP)
• iii-a2a — A2A protocol worker (HTTP on engine port)

Follows the worker pattern: iii worker add mcp / iii worker add a2a.

Usage

iii-mcp                     # MCP stdio (Claude Desktop, Cursor)
iii-mcp --no-stdio          # MCP HTTP only (POST /mcp)
iii-mcp --expose-all        # show all functions, ignore metadata filter
iii-a2a                     # A2A HTTP (POST /a2a + GET /.well-known/agent-card.json)
iii-a2a --expose-all        # show all functions as skills

Metadata filtering

Functions need metadata tags to appear as tools/skills:

iii.registerFunction({
  id: 'orders::process',
  metadata: { "mcp.expose": true, "a2a.expose": true }
}, handler)

Without the tag, functions stay hidden from agents. --expose-all disables filtering.

Structure

workers/
├── mcp/                    ← iii-mcp crate
│   ├── Cargo.toml
│   └── src/
│       ├── main.rs
│       ├── handler.rs
│       ├── prompts.rs
│       ├── transport.rs
│       └── worker_manager.rs
└── a2a/                    ← iii-a2a crate
    ├── Cargo.toml
    └── src/
        ├── main.rs
        ├── handler.rs
        └── types.rs

Publishing

Both crates use iii-sdk = { version = "0.10.0", path = "..." } — path for monorepo builds, version for crates.io publishing. Keywords and categories set for discoverability.

Commits

1. feat: add iii-mcp and iii-a2a protocol workers — initial implementation
2. fix: address CodeRabbit review — expose_all in HTTP, template escaping, A2A error envelope
3. fix: fail fast on missing function_id, clean up temp dir on spawn failure
4. fix: schema/impl consistency, safe serialize, remove builtins from HTTP, eliminate global static
5. refactor: move to workers/ dir, add version+path dual dep

Test plan

• cargo clippy -p iii-mcp -p iii-a2a -- -D warnings clean
• MCP stdio: initialize, tools/list, tools/call, resources/read, notifications
• MCP HTTP: POST /mcp tools/list + tools/call
• A2A: Agent Card, message/send, tasks/get, tasks/cancel (terminal check), tasks/list
• A2A: bad body returns -32600, missing function_id returns failed task
• --expose-all shows all functions
• 13/13 integration tests pass against live engine