compliance(storyboards): schema-driven mutations + contributes migration

[bokelley]

Summary

Bundles two follow-ups from #2661:

• #2669 — derive `MUTATING_TASKS` from request-schema `required: [idempotency_key]` declarations; replace the hardcoded list in `scripts/lint-storyboard-contradictions.cjs`.
• #2662 — adopt the `contributes: true` shorthand (adcp-client#693, shipped in `@adcp/client` 5.8.1) on the two universal branch-set storyboards.

Schema-driven mutations

`loadMutatingTasksFromSchemas` walks `static/schemas/source/` for `*-request.json` files whose top-level `required` array lists `idempotency_key`. Mirrors the existing `loadMutatingSchemaRefs` pattern in `scripts/build-compliance.cjs`.

`MUTATING_EXCEPTIONS` retains two carve-outs, each documented in the target schema's description:

• `comply_test_controller` — naturally idempotent (scenario enum is the dedup boundary).
• `si_terminate_session` — naturally idempotent (session_id is the dedup boundary). Added after protocol expert review flagged the omission.

Before this PR, the hardcoded set was missing `sync_audiences` entirely. Schema-driven derivation catches it automatically.

Drift guards

Four new tests in `tests/lint-storyboard-contradictions.test.cjs`:

1. Union invariant — `MUTATING_TASKS` equals `(schema-derived ∪ MUTATING_EXCEPTIONS)`. Breaks if someone adds to one side without the other.
2. No exception redundancy — `MUTATING_EXCEPTIONS` ∩ schema-derived is empty. Prevents a task accidentally carrying both justifications.
3. Positive anchor coverage — `create_media_buy`, `update_media_buy`, `sync_creatives`, `sync_audiences` MUST be in the derived set.
4. Negative anchor coverage — `get_products`, `get_signals`, `list_creative_formats`, `get_adcp_capabilities` MUST NOT be in the derived set. Guards against a read-schema drifting to require idempotency_key.

Also hardened `loadMutatingTasksFromSchemas`: throws on hyphen-to-underscore collisions across subdirs (previously silent via Set dedup), and skips symlinked directories to prevent unbounded recursion.

contributes migration

Four call sites migrated from `contributes_to: ` to `contributes: true`:

• `universal/schema-validation.yaml` — `past_start_reject_path` / `past_start_adjust_path`
• `universal/security.yaml` — `probe_invalid_api_key` / `probe_invalid_oauth_token`

Storyboard doc (`universal/storyboard-schema.yaml`) updated: both forms are documented as semantically equivalent, with the shorthand preferred inside branch_set phases.

Test plan

• `npm run test:storyboard-contradictions` — 19 tests pass (3 new drift guards + 1 negative anchor)
• `npm run test:storyboard-branch-sets` — 14 tests unchanged, all pass
• `npm run build:compliance` — all four storyboard lints pass
• Precommit (`test:unit` + `typecheck`) — 631 tests pass
• Storyboards run against `@adcp/client` 5.8.1 — 36/56 clean, 295 steps (above 35/279 floors)

Follow-ups

• #2675 — introduce `x-mutates-state: true` schema annotation to eliminate the `MUTATING_EXCEPTIONS` list entirely; decouples "mutation semantics" from "idempotency mechanism."

🤖 Generated with Claude Code