fix(codegen): upgrade to secure generator 0.64

[bokelley]

Summary

• upgrade datamodel-code-generator from 0.63.0 to 0.64.0, fixing GHSA-5578-w22f-pfx9 / CVE-2026-55415
• regenerate the checked-in model surface with the fixed generator
• normalize 0.64 typed additionalProperties annotations into Pydantic model classes so their value types are actually enforced at runtime
• update the extra-policy contract to recognize schema-valued additionalProperties

Security impact

Versions through 0.63.0 allow malicious schema values in x-python-import or customTypePath to inject Python statements into generated modules. Importing those generated modules can execute attacker-controlled code. Version 0.64.0 validates those paths.

The dependency is development-only here, but CI processes externally sourced schema bundles and imports generated output, so upgrading is preferable to dismissing the alert.

Compatibility

The 0.64 generator reshapes several internal generated unions/classes. Existing post-generation aliases preserve the supported public surface:

• public API snapshot passes
• code-generation contracts pass
• strict mypy passes
• full SDK test suite passes

Validation

• pip-audit: no known vulnerabilities
• deterministic regeneration: two consecutive 0.64 runs produced the same generated diff hash
• pytest tests/ -q --cov=src/adcp --cov-report=term-missing: 7,624 passed, 42 skipped, 9 deselected, 1 xfailed; 83.90% coverage
• repository pre-commit hooks: pass
• strict type checks: pass

Closes Dependabot alert #5.

[aao-secretariat]

Ladon verdict: Approve

Approve — security-driven codegen upgrade, clean review.

This PR upgrades datamodel-code-generator 0.63→0.64 (CVE-2026-55415) and regenerates the full Pydantic surface, plus two hand-written pieces: a new typed-additionalProperties inliner in post_generate_fixes.py (closes a real runtime-validation gap, tested) and _ergonomic.py coercions re-targeted to CreativeAsset/Creative matching the regenerated field types.

Checked the load-bearing concerns for this repo:

• Removed generated names are unreferenced outside _generated.py; the Creatives/Creatives1 back-compat aliases are preserved so aliases.py and canonical_creative.py still resolve — no discriminated-union fallback arm removed.
• _ergonomic.py change (high-risk (modified)) preserves coverage of regenerated names; reviewer found no medium-or-higher concern, so the modification is presumed safe.
• No forward-compat escape hatch removed, no discriminator key/value dropped.

No Critical/High/Medium findings. high_risk is true only via a (modified) entry with no accompanying medium finding, so row 5 does not fire. gated_paths is false. No no-auto-approve team match. Falls through to row 9 → approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean delta pass on PR #1132.

Checked:

• The change adds one conservative, AST-based codegen post-processing fix (remove_unused_pydantic_field_imports) plus its regeneration output in signal_value_type.py and unit tests.
• Usage detection fails safe, removal is idempotent and tested, and pipeline placement is correct.
• No wire-shape, semver, forward-compat, or import-layering surface is touched; _ergonomic.py modification carries no medium-or-higher concern.

Decision trace:

• No no-auto-approve team match (row 7 n/a).
• gated_paths: false — row 2 n/a despite review_decision: REVIEW_REQUIRED.
• high_risk: true but only reason is a (modified) file with no medium finding — rows 3/5 n/a.
• No critical/high/medium findings — rows 1/4/8 n/a. Prior decision was approve, so row 6 n/a.
• Falls through to row 9 → approve.