compliance(storyboards): contradiction lint + contributes shorthand (#2634)

[bokelley]

Summary

• Closes #2634 rules 1 (cross-storyboard contradictions) and 2 (orphan contributions, peer completeness).
• Dogfoods the contributes: true shorthand from adcp-client#693 (ships in @adcp/client 5.8.0). Migrates the two branch-set phases end-to-end.
• Rule 3 (field-entity-context) filed as Storyboard field-entity-context lint (rule 3 from #2634) #2660 — needs an upstream schema-annotation pass before it's tractable.

Contradiction lint

scripts/lint-storyboard-contradictions.cjs groups every step-with-assertions across all storyboards by:

• task
• Request fingerprint — canonical JSON of sample_request; strips idempotency_key + context.correlation_id; normalizes \$generate:*, \$context.*, {{prior_step.*}}, {{runner.*}} substitutions. Fixed a subtle bug in the first pass where JSON.stringify(value, arrayOfKeys) silently dropped nested fields because the key-filter applies at every depth.
• State-path fingerprint — ordered (task, request_fp) of prior mutating steps in the same phase + all earlier non-optional phases. The classic double-cancel pattern (first cancel → success, second cancel → NOT_CANCELLABLE) now has distinct state paths and doesn't collide.
• Env fingerprint — doc.id, comply_scenario, auth override, prerequisites.controller_seeding. Independent storyboard suites don't false-positive; two steps in the same suite with different scenarios are legitimately independent.

Flags groups whose outcomes disagree in a way no conformant agent can satisfy:

• success ↔ error (non-empty codes)
• disjoint error-code sets

Branch-set peers (same storyboard, same branch_set.id) are exempt by design — any_of semantics intentionally asserts mutually exclusive outcomes.

Contributes shorthand

@adcp/client 5.8.0 resolves contributes: true inside a branch_set: phase to the enclosing phase's branch_set.id. Three new branch-set lint rules mirror the runner's loader so authors see the violation at build time:

• contributes_both — step can't declare both contributes and contributes_to
• contributes_outside_branch_set — contributes: true needs a branch_set to resolve to
• contributes_bad_type — must be boolean

Migrated universal/schema-validation.yaml (past_start_handled) and universal/security.yaml (auth_mechanism_verified) to the shorthand.

Orphan-contribution rule

A fourth new branch-set rule: orphan_contribution — any contributes_to / contributes: true whose resolved flag has no matching assert_contribution any_of anywhere in the same storyboard is dead code. Complements no_assertion and peer_not_declared from #2646.

Test plan

• npm run test:storyboard-contradictions — 14 tests (source guard + fingerprint / outcome / state / env / peer-exemption coverage)
• npm run test:storyboard-branch-sets — 14 tests (4 new for the contributes + orphan rules)
• npm run build:compliance — all three lints run in sequence (scoping, branch-sets, contradictions)
• Precommit (npm run test:unit + npm run typecheck) — 631 tests pass
• Planted a synthetic contradiction; lint catches it and prints location + outcome shapes

Follow-up: #2660 (rule 3 field-entity-context lint, blocked on schema annotation work).

🤖 Generated with Claude Code