feat(compliance): add DOOH sales profile

[bokelley]

Depends on #5623. Merge #5623 first. This branch is stacked on the exact #5623 commits, so its shared placement-schema diff will disappear automatically after #5623 lands.

Summary

• add a precise sales-dooh specialism for non-guaranteed DOOH, using the existing Product and media-buy contracts rather than introducing a DOOH Product subtype
• exercise the typed placement inventory facts introduced by feat(schema): add DOOH structured selling-unit fields to placements #5623: venue identifiers, slot and loop duration, physical screen resolution, and motion capability; format_options remains the sole authority for accepted creative formats
• add a DOOH implementation guide and executable sandbox storyboard covering product selection, optional preflight, accepted creative sync, and deterministic delivery reconciliation at package and totals grain
• make source provenance irrelevant to buyers: every AdCP 3.2 product-list path must expose resolved canonical formats, including imported and pass-through sources; unsafe legacy references fail or are omitted before exposure
• expose sales-dooh from the reference sales tenant's executable capability response, including its DOOH portfolio channel
• keep vendor-defined attention metrics optional and identify auction allocation/share-of-voice as the remaining machine-readable DOOH gap
• add a 128 KiB MCP interoperability target, allow terse text summaries beside authoritative structuredContent, and align reference producers so payloads are not duplicated
• clarify that sandbox semantics are account-bound: natural keys repeat sandbox: true; account IDs select preverified sandbox accounts and cannot convert live accounts

Review focus

• Is sales-dooh correctly scoped as the non-guaranteed channel profile, with guaranteed-only DOOH continuing to use sales-guaranteed?
• Should auction-based DOOH gain a future typed allocation/share-of-voice contract beyond the placement loop and slot facts supplied by feat(schema): add DOOH structured selling-unit fields to placements #5623?
• Is 128 KiB the right recommended interoperability target for pageable/projectable MCP reads and tools/list pages?

Validation

• three expert design/review passes; final protocol, implementation, and workflow reviews found no blockers
• schema build and TypeScript typecheck passed
• placement catalog tests: 20/20 passed, including canonical-product exposure and DOOH merge semantics
• storyboard request, response, path, source-authority, enum, context-output, contradiction, documentation-parity, and docs-navigation checks passed
• reference sales-tenant HTTP test confirms the executable sales-dooh capability and DOOH portfolio channel
• the original profile implementation also passed the full pre-commit suite and current/AdCP 3.0 compatibility storyboard matrices; GitHub CI is rerunning against the updated heads

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated-path change requires human/CODEOWNERS approval.

This PR modifies protocol source files under static/schemas/source/** (comply-test-controller-request.json, comply-test-controller-response.json, enums/specialism.json), which are under the repo's hard, path-based approval gate (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so per decision rule row 2 the gate is not satisfied and the outcome must be escalate.

The reviewer found no blocking or medium findings: the change is purely additive (new sales-dooh specialism plus plays/dooh_metrics delivery-simulation support and an MCP content[].text de-duplication). Enum, docs, OpenAPI registry, taxonomy, and SPECIALISM_CATALOG are coherent; the minor changeset matches the additive, no-wire-removal surface; dooh_metrics uses allOf+$ref rather than a new undiscriminated oneOf; and the load-bearing single-package delivery checks are covered, including a new multi-package rejection test. The diff appears clean on the merits.

No critical/high/medium findings were surfaced, so this is not request-changes. But the gated-path approval gate stands until a human/CODEOWNERS approval flips review_decision to APPROVED.

Escalation reasons:

• Modifies gated protocol-source files under static/schemas/source/** — human/CODEOWNERS review required before merge (review_decision is REVIEW_REQUIRED, not APPROVED).

Why human review

• Modifies gated files under static/schemas/source/** (comply-test-controller-request.json, comply-test-controller-response.json, enums/specialism.json) with review_decision=REVIEW_REQUIRED — human/CODEOWNERS approval required (decision rule row 2).
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-response.json (modified) matches static/schemas/source/**; static/schemas/source/enums/specialism.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[bokelley]

Maintainer update:

• This PR now depends on feat(schema): add DOOH structured selling-unit fields to placements #5623 and is stacked on its exact commits. Please review/merge feat(schema): add DOOH structured selling-unit fields to placements #5623 first; the shared placement-schema diff will then disappear here.
• The DOOH design uses a sales-dooh specialization plus a guide and executable scenario, not a Product subtype.
• The scenario exercises canonical formats and the typed placement facts from feat(schema): add DOOH structured selling-unit fields to placements #5623 (venue, slot/loop, physical resolution, and motion), while keeping format_options authoritative for creative acceptance.
• The reference sales tenant now advertises the executable sales-dooh capability and DOOH portfolio channel.
• Expert protocol, implementation, and workflow reviews found no remaining blockers. Focused schema, storyboard, documentation, typecheck, and HTTP capability tests pass; CI is rerunning on the updated head.