fix(storyboards): make list_formats_integrity actually send format_ids (closes #2848)

[bokelley]

Summary

• The media_buy_seller / list_formats_integrity storyboard step asserts the seller round-trips a format_id filter verbatim, but the assertion was failing because the filter never reached the wire — the @adcp/client (≤5.11) list_creative_formats request builder returns {} and only envelope fields (context, ext, idempotency_key, push_notification_config) survive the runner's merge. The seller responded with its full unfiltered catalog and formats[0].format_id happened to be display_static ≠ the captured sponsored_product. Training-agent filter logic was already correct.
• Use the runner's context_inputs (applied after the builder runs) to inject the captured {agent_url, id} object at format_ids[0]. This is the documented escape hatch for "builder strips body fields"; first in-repo use, so the storyboard schema doc gets a corresponding context_inputs block tied to list_creative_formats request builder ignores sample_request — format_ids filter never reaches the wire adcp-client#797.
• Second sub-issue from media_buy_seller: format_id round-trip (substitution observer) + creative_fate_after_cancellation sync_creatives shape #2848 (creative_fate_after_cancellation sync_creatives shape) was already fixed by fix(storyboards): use literal creative_id in creative_fate reassign (closes #2850) #2867 / Storyboard YAML: creative_fate_after_cancellation reassign step resolves $context.creative_id to undefined, stripping required creatives[] #2850.

Test plan

• npm run build:compliance — clean
• npm run typecheck — clean
• All storyboard lints (scoping, branch-sets, contradictions, context-entity, auth-shape, test-kits, sample-request-schema) — pass
• ADCP_COMPLIANCE_DIR=dist/compliance/latest run-storyboards.ts --filter media_buy_seller (legacy dispatch) — 14/14 clean, 73 passed
• TRAINING_AGENT_USE_FRAMEWORK=1 ADCP_COMPLIANCE_DIR=… run-storyboards.ts --filter media_buy_seller — list_formats_integrity now passes; remaining failures on framework path are pre-existing session-state issues unrelated to media_buy_seller: format_id round-trip (substitution observer) + creative_fate_after_cancellation sync_creatives shape #2848.

Follow-up

• Drop context_inputs and rely on sample_request.format_ids once list_creative_formats request builder ignores sample_request — format_ids filter never reaches the wire adcp-client#797 ships and we bump the SDK pin.

🤖 Generated with Claude Code

[bokelley]

Expert review (ad-tech-protocol-expert + docs-expert) ran on the diff. Addressed in-scope feedback in 4c62d3a93:

• Reframed context_inputs doc to lead with the prohibition and name the observable symptom an author can diagnose from, instead of framing the field as an SDK-only escape hatch.
• Added an inline YAML snippet in the schema doc so authors don't have to navigate to the media-buy worked example.
• Cross-references added from the sample_request: field definition and the substitution-syntax section so authors land on context_inputs: instead of scrolling past the field.
• Documented the silent-no-op-on-missing-key behavior (distinct from $context.<name>'s loud unresolved_substitution) so the default path's better failure mode is visible.
• Acknowledged dependency-aware multi-instance dispatch as a legitimate non-workaround use.
• State type preservation explicitly.
• Pinned the inline comment to the published @adcp/client 5.10.0 (not ≤5.11, which is unreleased).

Out-of-scope follow-ups flagged by the reviewers (not blockers for #2848; will file separately if confirmed):

1. Out-of-catalog format probe is missing. The step's narrative at L313–318 calls out the "stale or typo'd format reference in the product catalog" failure mode, but this PR doesn't test it. A second probe asserting list_creative_formats(format_ids: [<unknown>]) returns empty formats[] — not a substitution — would close the proxying-gap side of the invariant.
2. agent_url echo semantics are underspecified. The seller's filter (training-agent) keys only on format_id.id; the field_value check requires deep equality on {agent_url, id}. For a tier-1 substitution-observer invariant, the spec should say explicitly whether a proxying seller MAY normalize agent_url on a filter lookup or MUST echo verbatim. Worth filing as a spec issue on the main repo.
3. sample_request.format_ids + context_inputs dual source of truth. Once we bump past the SDK release that ships docs: clarify inline creative handling (Option B) #789, sample_request.format_ids[0]: "$context.product_format_id" and context_inputs both apply (context_inputs writes last, so behavior is unchanged). The inline comment's "drop on SDK bump" is the mitigation; worth capturing as a follow-up issue tagged to the SDK bump so the cleanup doesn't orphan.
4. CI lint for workaround-comment convention. The "comment your context_inputs with an SDK version and upstream PR" rule is self-policing. A lint step that fails a PR adding context_inputs: without a tracking link near it would make "temporary bridge" enforceable rather than aspirational.

None of these change the correctness of this fix.