fix: guard against top-level setup in media buy responses

[bokelley]

Summary

Response builders (mediaBuyResponse, updateMediaBuyResponse, getMediaBuysResponse) now throw a descriptive error when setup appears at the top level of a media buy instead of nested inside account.setup.

Why

The IO-signing setup URL belongs on Account.setup, not on the media buy itself. Nothing in the schema has top-level setup on MediaBuy / CreateMediaBuySuccess / UpdateMediaBuySuccess, but DomainHandler accepts Record<string, unknown> (DX fix from #548), so TypeScript stops catching the mistake. Storyboard "expected" narrative uses setup.url shorthand, which agent builders were mirroring as a top-level field.

Error

mediaBuyResponse: `setup` is not a field on the media buy — it belongs inside
`account.setup`. Move `{ setup: { url, message } }` to
`{ account: { ..., setup: { url, message } } }`. The setup URL is a property
of the Account (returned alongside `status: 'pending_approval'`), not the MediaBuy.

Related

• Discovered in docs: add Implementation Traps section to build-seller-agent skill #502 review. Complements the SKILL.md Common Mistakes rows there.
• Storyboard narrative wording (setup.url → account.setup.url) to be filed as a separate issue on adcontextprotocol/adcp.

Test plan

• 3 new unit tests in test/server-responses.test.js (throws for each builder, accepts nested case)
• Full test suite: 3174 pass / 0 fail / 2 skipped
• Changeset included (patch)

🤖 Generated with Claude Code