feat(cli): --invariants flag to register storyboard assertion modules

[bokelley]

Summary

Follow-up to #692 (storyboard assertion registry). Adds a CLI surface so operators can dynamic-import assertion modules before the runner resolves storyboard.invariants: [...].

adcp storyboard run ... --invariants ./my-invariants.js,@adcp/invariants imports each specifier at CLI entry, triggering each module's registerAssertion(...) calls. Without this, storyboards that declare invariants would fail at runner start with "Storyboard references unregistered assertion" because nothing is wired to populate the registry.

The framework intentionally keeps concrete assertions out of @adcp/client (they ship from adcontextprotocol/adcp alongside the specialisms that own them). This flag is the missing hook for that to happen.

Shape

adcp storyboard run test-mcp sales-non-guaranteed \
  --invariants ./my-invariants.js,@adcp/invariants

• Comma-separated list; relative paths resolve against cwd; bare specifiers pass through as npm packages; path.isAbsolute for Windows parity.
• Runs before the --dry-run gate so bad specifiers surface during preview, not after auth/agent resolution.
• Wired at all three storyboard entry points: handleStoryboardRun, handleMultiInstanceStoryboardRun, and the comply path through runFullAssessment.
• Filtered from positionalArgs so module specifiers aren't mistaken for agent aliases.

Test plan

• Single module loads and registers at import time (marker-file verified)
• Comma-separated multi-module load
• Missing value → exit 2 with clear message
• Broken module (throws at import) → exit 2 with error surfaced
• Missing path → exit 2 with error surfaced
• Positional filter doesn't confuse specifier with agent arg
• Whitespace-only value (\" , , \") → exit 2, not silent no-op
• Multi-instance path (--url ... --url ...) also loads modules
• 44 neighbor tests (registry, webhook-receiver, file-flag, multi-instance) still green

Related

• Follows feat(storyboard): cross-step assertion registry + runner hooks (adcp#2639) #692 — the registry framework
• Unblocks adcontextprotocol/adcp shipping concrete invariants via npm packages

🤖 Generated with Claude Code

[bokelley]

CI "Test & Build" failure is pre-existing on main: same 2 failures in test/lib/storyboard-completeness.test.js (expect_substitution_safe has a registered response schema and storyboard: sales_catalog_driven). Both tasks are newly added upstream in the compliance tarball and the SDK hasn't caught up; unrelated to this PR. Verified locally by running the test on main.