fix(compliance): keep list_accounts discovery unscoped

[bokelley]

Summary

• consume @adcp/sdk 13.0.0-rc.18 so broad list_accounts storyboard requests no longer receive a noncanonical root brand or synthetic account filter
• correct the compliance runner's input_schema_field_stripped notice so payload drift is not blamed on an agent schema
• retain and re-lock the separate temporary get_products capability shim to rc.18, with its source-shape and installed-runtime tests
• update the verification guide's extracted-cache example to rc.18

Upstream runtime fix: adcontextprotocol/adcp-client#2528
SDK release: adcontextprotocol/adcp-client#2529

Validation

• npm run test:sdk-shims (12/12)
• npm run test:storyboard-check-enum (7/7)
• npm run build:compliance -- --check
• npm run typecheck
• installed rc.18 runStoryboard smoke: broad list_accounts request remains { sandbox, pagination } with no root brand or synthetic account
• npm run test:docs-nav
• npm run test:owned-links

Closes #6437

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS approval.

This PR modifies .agents/sdk-shim-ledger.json, which matches the .agents/** hard approval gate (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so the deterministic gate (decision table row 2) is not satisfied and the PR cannot be approved.

No blocking findings. The reviewer found the change clean: a coordinated @adcp/sdk rc.17 → rc.18 bump (package.json, lock, shim ledger, patch script, docs, tests all consistent) plus a task-neutral rewrite of the input_schema_field_stripped compliance notice (runner-output-contract 2.9.0 → 2.9.1) with a covering test. Changeset present and protocol-scoped; no spec drift, no immutable-artifact edits, no stale rc.17 references. High-risk flag is false.

Escalation reasons:

• .agents/sdk-shim-ledger.json (modified) is under the .agents/** hard approval gate; review_decision is REVIEW_REQUIRED. Human / CODEOWNERS approval is required before merge.

Once a real approval lands, this PR falls through to a clean approve.

Why human review

• .agents/sdk-shim-ledger.json (modified) is under the .agents/** hard approval gate and review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required.
• This PR touches a path under a hard, non-overridable approval gate (.agents/sdk-shim-ledger.json (modified) matches .agents/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.