feat(media-buy): define PackageRequest selector compatibility

[bokelley]

Summary

• define deterministic resolution, equivalence, and error precedence when a PackageRequest contains multiple format selector routes
• add CONFLICTING_SELECTORS and enforce atomic fixed-image dimensions
• enforce the contract in the training seller for create and add-package updates, including set/range narrowing, URL-canonical legacy matching, and legacy-only compatibility
• expand and version the canonical-format compliance storyboard, including an explicit runner contract

Why

AdCP 3.2 authoring guidance stopped recommending dual emission, but receiver behavior remained ambiguous for older 3.x requests that contain both canonical and legacy selectors. This change preserves compatible legacy traffic while making mismatches and unresolved selectors deterministic.

Compatibility

• legacy-only requests remain supported
• equivalent canonical and legacy selectors remain supported
• new buyers should emit exactly one canonical selector route
• mismatched resolvable routes return CONFLICTING_SELECTORS; unresolved routes return UNSUPPORTED_FEATURE

Validation

• npm run build
• npm run typecheck
• npm run test:schemas
• npm run test:composed
• focused placement schema and compliance generation/checks
• training-agent unit suite (647/647)
• tenant smoke suite (30/30)
• focused canonical-format storyboard (21 passed, 2 skipped for the linked SDK blocker)
• three expert review passes covering protocol correctness, implementation quality, and test coverage

Integration note

The packaged SDK currently canonicalizes away deprecated co-present format_ids and still grades direct selectors with non-directional precedence. The local runner narrowly exempts those checks while raw receiver unit coverage remains active. Remove the exemptions when adcp-client#2392 lands.

Closes #6648

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema paths require human/CODEOWNERS review, and this PR ships a new breaking-class protocol contract.

This PR modifies gated schema source files under static/schemas/source/** (enums/error-code.json, media-buy/package-request.json) while review_decision is REVIEW_REQUIRED — the hard approval gate (row 2) is not satisfied.

Additionally, the change defines a new 3.x PackageRequest multi-route selector contract: a new error code (CONFLICTING_SELECTORS), new atomic width/height enforcement, and new normative resolve-then-equivalence precedence rules. New error codes / new normative requirements on published schema are breaking-class protocol changes, and per the repo's hard gate, ratification of breaking-class changes is a human act that is never auto-approved absent review_decision: APPROVED.

No blocking (critical/high) defects were found by the reviewer — schema↔docs coherence holds, the changeset is present and appropriately scoped, and the training seller enforcement is fail-closed with 538 lines of new tests. The only findings are two low-severity notes (fail-closed control flow; positional selector regrafting). But both the deterministic gated-path gate and the breaking-class governance gate require explicit human review before merge.

Escalation reasons:

• Gated paths touched (static/schemas/source/enums/error-code.json, static/schemas/source/media-buy/package-request.json) with review_decision: REVIEW_REQUIRED — human/CODEOWNERS approval required.
• Breaking-class protocol change (new CONFLICTING_SELECTORS error code + new normative selector-precedence requirements) — ratification is a human act.

Why human review

• Modifies gated schema source files (static/schemas/source/enums/error-code.json, static/schemas/source/media-buy/package-request.json) while review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required before merge (decision-table row 2).
• Breaking-class protocol change: introduces new error code CONFLICTING_SELECTORS and new normative multi-route selector precedence requirements on published schema — repo hard gate requires human ratification, never auto-approved absent review_decision: APPROVED.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/media-buy/package-request.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.