compliance(storyboards): fixture-hash normalization + requires_scenarios spec

[bokelley]

Summary

Two hygiene follow-ups from #2679's expert review:

• #2682 — sort fixture arrays by primary id before hashing, closing a false-negative env-fingerprint envelope.
• #2683 — normative spec language for how `branch_set` contribution flags flow across `requires_scenarios:` boundaries, aligning the schema with the `orphan_contribution` lint shipped in compliance(storyboards): richer env fingerprint + requires_scenarios resolution #2679.

Fixture hash normalization (#2682)

`fingerprintEnv` now sorts arrays within each documented fixture category by its primary id before `stableStringify`. Two storyboards with semantically equivalent fixtures — `products: [A, B]` vs `products: [B, A]` — land in the same env bucket. Closes the false-negative envelope before `#2670 part 2` removes `sb=<doc.id>` and makes env-fingerprint precision load-bearing.

Sort keys (mirrors the schema's `fixtures:` block):

• `products → product_id`
• `pricing_options → pricing_option_id`
• `creatives → creative_id`
• `plans → plan_id`
• `media_buys → media_buy_id`

Unknown fixture categories throw — a new seed category added to the schema without updating `FIXTURE_CATEGORY_PRIMARY_ID` is a hard error. Forces schema-doc and lint updates to land together so a silent false-negative bucket can't emerge.

requires_scenarios spec (#2683)

`storyboard-schema.yaml` now normatively describes the flow of `branch_set` contribution flags between a parent storyboard and its linked scenarios:

• A flag contributed in parent X is considered asserted if either X's own phases assert it OR a scenario Y in `X.requires_scenarios` asserts it via `assert_contribution any_of`.
• Reverse flow is prohibited — scenarios MUST be internally self-grading to preserve standalone lintability and prevent cycles in the composition graph.
• Scenario IDs must match the referenced file's top-level `id:` exactly, and the file MUST exist at build time.

Matches the `orphan_contribution` lint behavior shipped in #2679. The lint was the de facto spec; this PR closes the gap.

Test plan

• `npm run test:storyboard-contradictions` — 25 tests (3 new: array-order stability, content-difference still discriminated, unknown-category throws + documented categories round-trip)
• `npm run test:storyboard-branch-sets` — unchanged, 19 tests pass
• `npm run build:compliance` — all four storyboard lints green
• Precommit (`npm run test:unit` + `typecheck`) — 631 tests pass
• Expert review (code + protocol) applied: throw on unknown fixture category, strengthened reverse-flow restriction, scenario file existence in spec

Follow-up filed

• #2687 — `unresolved_scenario_reference` grading reason + lint hard error on missing scenario files. Symmetrizes with the duplicate-`doc.id` throw already in `buildScenarioFlagIndex`.

🤖 Generated with Claude Code