feat(compliance): pagination integrity for get_media_buys

[bokelley]

Closes #3111

Summary

Fourth in the rolling pagination conformance series (#3095, #3100, #3109). Adds cursor-based pagination to handleGetMediaBuys and a new get-media-buys-pagination-integrity.yaml conformance storyboard.

Non-breaking justification: pagination was already an optional field in get-media-buys-response.json ($ref: core/pagination-response.json). Existing callers receive an additional field they can safely ignore; the media_buys array shape is unchanged.

Changes

server/src/training-agent/task-handlers.ts

• Defensively adds pagination?: { max_results?: number; cursor?: string } to GetMediaBuysArgs (widening in case the generated GetMediaBuysRequest type omits it)
• When media_buy_ids is present → direct lookup, pagination skipped, all matching buys returned (per request-schema semantics: "When omitted, returns a paginated set")
• When media_buy_ids is absent → reads max_results (default 50, cap 100), decodes cursor, slices post-filter buys, emits pagination: { has_more, total_count, cursor? }
• Returns INVALID_REQUEST on malformed cursor
• New encodeMediaBuyCursor/decodeMediaBuyCursor using mb:offset:<n> prefix — namespaced so a get_media_buys cursor is rejected by decodeCreativeCursor (and vice versa), preventing silent wrong-offset reads. Will unify with shared encodeOffsetCursor once feat(compliance): get_signals pagination cursor integrity #3109 merges

Design note: when both media_buy_ids and pagination.cursor are provided, the cursor is intentionally ignored — ID-lookup semantics win (documented in code comment; flagged and accepted in pre-PR protocol review).

static/compliance/source/universal/get-media-buys-pagination-integrity.yaml

• 3 active media_buy fixtures via controller_seeding: true
• Phase 1: capability discovery
• Phase 2: pagination walk — first_page (max_results=2, assert has_more=true + cursor present) → terminal_page (follow cursor, assert has_more=false + cursor absent)
• No query_summary assertions — get-media-buys-response.json does not define that field

server/tests/unit/training-agent.test.ts — 3 new tests:

1. Full pagination walk: create 3 buys → page1 (has_more=true, cursor, total_count=3) → page2 (has_more=false, no cursor, total_count=3)
2. Malformed cursor → INVALID_REQUEST
3. media_buy_ids bypasses pagination → all 3 returned, no pagination block

Pre-PR review

• code-reviewer: approved — no blockers; two nits (server-instance comment in tests, encodeCreativeCursor namespace tech-debt inherited from pre-existing code)
• ad-tech-protocol-expert: approved — cursor namespace correct; total_count semantics correct (post-filter, pre-slice); storyboard correctly omits query_summary; silent-ignore contract for cursor+ID-lookup conflict is documented in code comment

Nits noted (not fixing in this PR)

• Test uses three server instances that share a module-level InMemoryStateStore — this is correct behavior, a comment would help future readers
• GetMediaBuysArgs.pagination uses a local type literal rather than the canonical PaginationRequest type from @adcp/client — low blast radius now, will matter more once feat(compliance): get_signals pagination cursor integrity #3109 ships the shared codec

Session: https://claude.ai/code/session_01YQwRdKHrxUzQrYEGk2dMDT

---

Generated by Claude Code