fix(compliance): remove payload_must_contain over-fit; extend identifier_paths echo across 4 storyboards

[bokelley]

Closes #3969

Summary

Two coupled fixes to the 5 storyboards that adopted upstream_traffic in #3962.

Part A — Remove Meta-shape payload_must_contain over-fit (3 storyboards)

sales-social/sync_audiences and audience-sync/create_audience declared payload_must_contain: [{path: "users[*].hashed_email"}], which assumes Google Customer Match / Meta CAPI nesting. TikTok, Snap, and Pinterest use completely different path shapes — these adopters' conformance runs were failing the check despite forwarding identifiers correctly. identifier_paths already provides shape-agnostic value-echo verification (asserts the supplied value appears at any depth); payload_must_contain added only a shape constraint that's redundant in the best case and a false positive in every non-Meta case.

signal-marketplace/activate_on_platform had the same problem with payload_must_contain: [{path: "segment_id"}] — TTD-shaped, fails Xandr, Amazon DSP, Yahoo DSP, and others. Replaced with identifier_paths: ["signal_agent_segment_id"] (schema spec confirms identifier_paths resolves from the post-substitution request, so the context-resolved segment ID is extracted correctly).

Also replaced real brand name the-trade-desk / agency-123-ttd with fictional pinnacle-dsp / agency-123-pd per playbook.

Part B — Extend cross-step identifier_paths echo (4 storyboards)

sales-social was the only storyboard using the cross-step pattern (same hashed_email value asserted in both sync_audiences and log_event upstream traffic). Extended the pattern:

• signal-marketplace/activate_on_platform: identifier_paths: ["signal_agent_segment_id"] replaces payload_must_contain (see Part A)
• creative-ad-server/build_tag: added identifier_paths: ["creative_id"] to existing upstream_traffic check
• audience-sync/delete_audience: new upstream_traffic check with identifier_paths: ["audiences[*].audience_id"] (method-agnostic — no endpoint_pattern since deletion APIs vary by platform)
• sales-non-guaranteed/update_media_buy: bare upstream_traffic check (no identifier_paths — media_buy_id is seller-assigned, $context.* value, not a buyer-supplied literal; bare check verifies upstream propagation happened)

Non-breaking justification

All changes are to the conformance harness (static/compliance/source/specialisms/), not published schemas or task definitions.

• Part A (removals): relaxing assertions — previously failing (non-Meta) adopters become passing; Meta adopters are unaffected since identifier_paths covers their values.
• Part B (additions): additive upstream_traffic checks grade not_applicable for any adopter not advertising query_upstream_traffic via list_scenarios. Only opt-in adopters see stricter checks. upstream_traffic was introduced in feat(compliance): bump @adcp/sdk to 6.7.0 + adopt upstream_traffic on 5 storyboards #3962 (recent); no conformant implementation was relying on the absence of these assertions.
• Changeset: --empty (conformance harness, not published protocol spec).

Pre-PR review

• ad-tech-protocol-expert: approved — correct removal of shape-specific over-fit; identifier_paths is strictly stronger; found 2 blockers (both fixed): endpoint_pattern: "POST *" on delete_audience → removed (method-agnostic); since: create_media_buy on update_media_buy → removed (included create traffic, defeating the check; default window "since this step's request" is correct).
• code-reviewer: approved — confirmed identifier_paths resolves post-substitution values (runner-output-contract.yaml line 395); nit on overclaiming comment (fixed). Raised since: create_media_buy as "missing" based on original diff; protocol expert explicitly flagged its presence as a blocker (widens window to include create traffic). Current state — no since — is the correct resolution per spec (storyboard-schema.yaml lines 1110-1124).

Triage-managed PR. This bot does not currently iterate on review comments or PR conversation threads (only on the source issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> → fix → push.
• Or re-trigger: comment /triage execute on the source issue.

See #3121 for context.

Session: https://claude.ai/code/session_01Tmvr85NJQwDR9QWEciSZk7

---

Generated by Claude Code