perf(a2a/canonical): use bytes.NewReader on Canonicalize input — drop string copy

[perlowja]

Summary

Canonicalize previously wrapped its []byte input as
`strings.NewReader(string(data))`. The `string([]byte)` conversion
forces a full heap copy of the input bytes before feeding the
json.Decoder. For large agent cards / task payloads on signature hot
paths, that's an allocation roughly the size of the canonical input per
call.

bytes.NewReader(data) exposes the same io.Reader interface to
json.NewDecoder while sharing the caller's existing slice — zero
extra bytes, zero extra copies. The decoded JSON tree (and therefore
the canonical output) is byte-for-byte identical because both readers
feed the same bytes into the tokenizer.

All existing tests continue to pass.

```
$ go test ./internal/a2a/ -count=1
ok github.com/bubblefish-tech/nexus/internal/a2a 0.250s
```

Signed-off-by: Jason Perlow jperlow@gmail.com

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}