fix(media-buy): accept compact version envelope

[bokelley]

Summary

• accept the deprecated adcp_major_version field on the strict buy_products, accept_proposal, and control_media_buy request schemas
• add an SDK integration regression test covering the default auto version envelope across all seven compact lifecycle tools
• add a patch changeset for the restored 3.x compatibility behavior

Root cause

The three compact mutation schemas declared adcp_version but omitted adcp_major_version while also setting additionalProperties: false. SDK clients correctly emit both fields throughout AdCP 3.x, so strict servers rejected the request before dispatch.

Impact

SDK 14 clients and other 3.x buyers can use the documented compatibility envelope with every compact media-buy lifecycle tool. Regenerated request types will also expose the legacy compatibility field consistently.

Validation

• independent protocol, code, and Node testing expert reviews: no findings
• pre-fix replay: all three affected schemas reject the real SDK auto envelope specifically on adcp_major_version
• npm run test:version-envelope
• npm run test:schemas
• npm run test:composed
• npm run test:mcp-schema-projection
• npm run test:sdk-shims
• npm run typecheck
• current-source storyboard matrix: all tenants pass
• released 3.0.24 compatibility storyboard matrix: all tenants pass
• changeset protocol scope check

Fixes #6645

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated-path change requires human/CODEOWNERS review.

This PR adds the deprecated optional adcp_major_version field (via $ref to core/version-envelope) to three strict compact media-buy request schemas (accept-proposal-request, buy-products-request, control-media-buy-request) that previously omitted it under additionalProperties: false. This restores parity with the four sibling compact tools, aligns with the documented "emit both through 3.x" guidance, ships a correct patch changeset, and adds an SDK-driven regression test across all seven lifecycle tools. The reviewer found no critical/high/medium findings — the diff is clean, additive, no dist mutation, no hand-edited version.

However, the changed files match static/schemas/source/**, which is a declared gated path (hard, deterministic approval gate). review_decision is REVIEW_REQUIRED, not APPROVED, so decision-table row 2 fires: the gate is not satisfied and the outcome must be escalate rather than approve.

Escalation reasons

• Modifies gated protocol-source files under static/schemas/source/** (accept-proposal-request.json, buy-products-request.json, control-media-buy-request.json); review_decision is REVIEW_REQUIRED. Human/CODEOWNERS approval is required before merge.

No blocking findings — once a human/CODEOWNERS approval lands, this is a clean approve.

Why human review

• Modifies gated protocol-source files under static/schemas/source/** (accept-proposal-request.json, buy-products-request.json, control-media-buy-request.json) and review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required before merge.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/media-buy/accept-proposal-request.json (modified) matches static/schemas/source/**; static/schemas/source/media-buy/buy-products-request.json (modified) matches static/schemas/source/**; static/schemas/source/media-buy/control-media-buy-request.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.