test(training-agent): omit bearer in create_media_buy 401 assertion (#3080)

[bokelley]

Closes #3080

Summary

Two-part fix for the /mcp-strict 401 test that was failing even after PR #3082 merged.

Root cause: callTool sends Authorization: Bearer test-token-for-strict by default. The SDK's requireAuthenticatedOrSigned short-circuits on a successful bearer result before the required_for gate runs (auth-signature.js:146-147: if (fallbackResult !== null) return fallbackResult). This is intentional SDK behavior per #2586 — a valid credential is sufficient even when signing is required for unauthenticated callers. PR #3082's resolveOperation rawBody fix only helps when bearer returns null; with a valid bearer present, resolveOperation is never reached in the required_for code path.

Fix 1 — omit bearer: Pass { auth: false } on the failing test call to suppress the bearer token. This models the actual grader scenario: compliance graders don't carry bearer tokens — they authenticate via RFC 9421 signature credentials only. With no bearer and no signature on a required_for op, the gate fires and returns 401 request_signature_required.

Fix 2 — correct www-authenticate assertion: The test was asserting /^Bearer / on the WWW-Authenticate header. Per index.ts:207 and static/compliance/source/universal/signed-requests.yaml:52/188, respondUnauthorized({ signatureError }) emits WWW-Authenticate: Signature error="<code>", not a Bearer challenge. Fixed to /Signature error="request_signature_required"/, pinning exactly what the compliance grader reads.

Non-breaking justification: Server integration tests only. No schema, task definition, wire protocol, or public API surface changed.

Aside — CI gap: Vitest integration tests don't run in CI for this repo, which is why #3082, #3079, and the original regression all reported clean CI with a failing test. Wiring vitest into the CI pipeline needs a separate human-authored PR touching .github/workflows/.

Pre-PR review (two iterations)

Iteration 1:

• code-reviewer: approved — { auth: false } is type-safe per callTool's signature; no test overlap with existing POST /mcp-strict without auth assertion (different tool, different rejection reason).
• ad-tech-protocol-expert: blocker — www-authenticate assertion /^Bearer / is wrong for the signatureError code path; grader reads Signature error="..." scheme, not Bearer.

Iteration 2 (after fixing blocker):

• ad-tech-protocol-expert: signed off — blocker resolved; both commits logically complete; assertion now matches the actual wire format from respondUnauthorized({ signatureError }); regex correctly non-anchored to tolerate additional challenge parameters.

Session: https://claude.ai/code/session_01S7aDiMrwhfYPr7FzYQdn9C