feat: comply_test_controller on training agent

[bokelley]

Summary

• Implement comply_test_controller tool on the training agent, enabling deterministic lifecycle testing for the @adcp/client comply engine
• Supports 6 scenarios: force_creative_status, force_account_status, force_media_buy_status, force_session_status, simulate_delivery, simulate_budget_spend
• All transitions enforce the same state machine rules as production — invalid transitions return INVALID_TRANSITION, unknown entities return NOT_FOUND
• Simulated delivery data surfaces through get_media_buy_delivery
• Fix misleading SISessionStatus description in si-initiate-session-response.json

Security

• Sandbox-gated: requires account.sandbox: true (returns FORBIDDEN otherwise)
• Session-isolated: no cross-session state mutation
• Validate-before-mutate: all state checks happen before writes
• Input truncation in error messages

Test plan

• 32 unit tests covering all scenarios, valid/invalid transitions, idempotency, NOT_FOUND, terminal states, delivery/budget simulation
• 3 sandbox gating tests (no sandbox, sandbox: false, no account)
• 204 existing training agent tests still pass
• Full pre-commit hook suite passes (schemas, types, lint, all test suites)

Closes #1694
Closes #1693

🤖 Generated with Claude Code

[bokelley]

Implementation looks solid — state machine tables are correct, sandbox gating works, error codes match the spec, and test coverage is thorough. A few things:

1. archived is not terminal in the creative transition table

The table has archived: ['approved'] which means archived creatives can be unarchived. This is fine if that's the intended spec behavior, but worth calling out: the @adcp/client deterministic creative scenario currently tests archived → processing as the invalid-transition case, which works since that specific path isn't in the table. But the scenario description says "archived is terminal" — it's not terminal here, just restricted. We'll align the client-side scenario language.

2. force_account_status changes status but nothing gates on it

getAccountStatus is exported but I don't see it wired into create_media_buy or any other handler to enforce operation gates. So if comply calls force_account_status(suspended) then tries create_media_buy, the media buy will succeed because handleCreateMediaBuy doesn't check the account status.

This means the testAccountStateMachine scenario in @adcp/client (which verifies create_media_buy is blocked when suspended) will fail against this training agent. Either:

• Wire getAccountStatus into handleCreateMediaBuy to return an error when suspended/payment_required/closed
• Or we skip the operation-gate test in the client until this is wired

The status tracking itself is correct — it's just the enforcement that's missing.

3. SI sessions: unknown session IDs are implicitly active

handleForceSessionStatus treats unknown session IDs as implicitly active rather than returning NOT_FOUND. This is pragmatic for testing (comply creates a session via si_initiate_session, then the controller needs to find it) but means NOT_FOUND is never returned for sessions. Not a blocker — just noting the asymmetry with creative/media buy which do return NOT_FOUND.

4. simulate_delivery integration is clean

The getDeliverySimulation export wired into handleGetMediaBuyDelivery is exactly right — additive simulation data flows into the real delivery response. This is the pattern the spec calls for.

Overall this is ready to merge with just #2 as a follow-up (or in this PR if it's easy to add the account status check to handleCreateMediaBuy).