docs(auth): tenant resolution + close #2577 runtime follow-ups

[bokelley]

Summary

Reframes the ID-scoped-task envelope-identity injection in compliance storyboards as a sandbox routing convention, not a pending spec follow-up, and closes the open runtime/cleanup items from #2577.

After reviewing the runtime reverse-index proposal with protocol-design and product lenses:

• Production sellers resolve tenant from the authenticated principal (bearer / mTLS / RFC 9421), not envelope payload. Adding a cross-session reverse index in the training agent just to move identity off the wire in storyboards would be sandbox plumbing without spec meaning.
• Storyboards keep carrying envelope identity on the seven ID-scoped exempt tasks because sessionKeyFromArgs routes by payload; the lint (already relaxed in feat(compliance): scoping lint exempts ID-scoped tasks (#2577 Option C) #2578) just stops enforcing it.
• The three tasks without a required globally-unique scope-ID (preview_creative, build_creative, get_plan_audit_logs) stay in TENANT_SCOPED_TASKS — lint-enforced envelope identity matches how sandbox storyboards have to work anyway. Schema adjustments remain a separate design call.

Docs changes

• New Tenant resolution section in docs/building/integration/authentication.mdx — normative statement that AdCP resolves tenant from the authenticated principal, with the ID-scoped-tasks rationale called out so production implementors and certification candidates don't absorb the sandbox convention as the spec.
• docs/contributing/storyboard-authoring.md now labels envelope-identity injection on the seven ID-scoped tasks as a sandbox routing convention and links to the auth doc.
• scripts/lint-storyboard-scoping.cjs header comment matches.

Expert review incorporated

• Protocol-design review confirmed the framing is correct and analogous to OpenRTB (seat from connection/TLS, not payload), sellers.json, and ads.txt (identity resolved out-of-band, not in-payload). Flagged routed/brokered topologies as the one real exception — that's a schain-equivalent design question, not this one.
• Product review flagged storyboard-author confusion and certification mental-model risk as real-but-low cost. Mitigated here by the new auth-doc section (one link, one sentence inoculates the cohort), the storyboard-authoring reframing, and the matching lint header comment.

Test plan

• npm run build:compliance — storyboard scoping lint passes, compliance builds clean
• npm run build — full site build succeeds
• npm run test:unit — 587/587 pass
• tsc --project server/tsconfig.json --noEmit — clean
• CI green on GitHub
• #2577 closed with the summary comment after merge

🤖 Generated with Claude Code

[github-actions]

Schema Link Check Results

Commit: 4b17f69 - docs(auth): tenant resolution section + close #2577 runtime follow-ups

⚠️ Warnings (schema not yet released)

These schemas exist in source but haven't been released yet. The links will be broken until the next version is published:

• https://adcontextprotocol.org/schemas/v3/enums/specialism.json
  • Schema exists in latest (source) but not yet released in v3
  • Action: This link will work after next 3.x release is published

---

To fix: Either:

1. Wait for the next release and merge this PR after the release is published
2. Use latest instead of a version alias if you need the link to work immediately (note: latest is the development version and may change)
3. Coordinate with maintainers to cut a new release before merging