docs: correct A2A signing and transport docs, supported versions; drop em-dashes

[vvillait88]

Summary

Doc corrections from an audit of every repo's docs against code, plus an em-dash sweep.

• SECURITY.md listed 2.x as the supported line; the package is on 3.x.
• README A2A example called the card a "Signed Agent Card" whose identity claims live in a separate JWS wrapping it. buildA2AAgentCard returns the card unsigned, and an A2A 1.0 card carries its JWS entries in its own signatures field. The comment now says that.
• A2A_DEFAULT_TRANSPORT reads JSONRPC while buildA2AAgentCard defaults to HTTP+JSON. The constant is A2A's own default binding, so its value stays; the comment beside it now says which is which. The A2AAgentInterface doc comment described the pre-1.0 card (url + preferredTransport + additionalInterfaces); it now describes the builder input that becomes supportedInterfaces.
• A2A module doc comment said to "wrap" the card in a signature and called the spec "Google A2A"; it now says to attach the JWS entries as signatures.
• "the 2.0 high-level surface" removed from the README and CLAUDE.md (version-introduction text, and the package is on 3.x).
• CLAUDE.md /api row now lists the four names src/api re-exports, not two.
• examples/README.md: the compute-first example uses computeFirstCheckout, which is backed by createQuoteCache; it does not import the cache itself.
• A broken //, comment in the README UCP example is fixed.
• Em-dashes removed everywhere except the one test that asserts skill.md output contains none. A spaced em-dash became a colon; dashes used as a pair became parentheses. This touches agent-facing strings (denial instructions, skill.md text), which ship in the next release; no release is cut for this alone.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported name, signature or value changed. String content in agent-facing text changed punctuation only.

Test plan

bun run lint, bun run typecheck and bun run test (1849 passed, 4 skipped) all exit 0. Repo-wide em-dash count afterwards: 1, the assertion in tests/discovery/skill_md.test.ts.

Checklist

• Tests cover the new behavior, and the suite passes locally (no behavior changed; suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests