feat(training-agent): truth-of-claim verifier (PROVENANCE_CLAIM_CONTRADICTED)

[bokelley]

Closes #3802 at the spec/contract level. Adds the seller-side truth-of-claim verifier on top of the structural enforcement landed in #3792.

What this ships

`server/src/training-agent/task-handlers.ts`

• `handleGetCreativeFeatures` — governance-agent-shaped handler returning deterministic AI-detection results. Detection encoded in the creative manifest's asset URL pattern: substring `ai-generated-true` / `ai_gen_true` → `ai_generated: true`; `ai-generated-false` / `ai_gen_false` → `false`. When neither URL pattern matches, derives from buyer-claimed `digital_source_type` via the canonical AI_TRUE_DST set (trained_algorithmic_media, composite_with_trained_algorithmic_media, composite_synthetic, algorithmic_media). Storyboards drive contradiction outcomes from the fixture without per-test stateful bookkeeping.

• `runProvenanceVerifier` — in-process verifier-call helper invoked by `enforceProvenancePolicy` after the structural-rejection cascade. Selects the buyer-nominated verifier when on-list, falls back to the first on-list entry (with `substituted_for` audit trail). Threshold: `ai_generated=true` with confidence ≥ 0.9 against a non-AI `digital_source_type` claim → contradiction. The reverse (claims AI but verifier sees non-AI) is NOT a contradiction; buyers may conservatively over-disclose.

• `enforceProvenancePolicy` is now async — calls the verifier after the five structural checks. Emits `PROVENANCE_CLAIM_CONTRADICTED` with audit-safe `error.details` per the `error-code.json` description's allowlist: `{ agent_url, feature_id, claimed_value, observed_value, confidence, substituted_for? }`. No `detail_url`, no verifier extension fields — that's the trust boundary preventing verifier responses from leaking cross-tenant data through the seller. Buyer-controlled strings are sanitized before interpolation.

`static/compliance/source/protocols/media-buy/scenarios/provenance_truth_of_claim.yaml`

Fleshed out from skeleton to a 3-phase scenario:

1. discover_verifier — `get_products` surfaces `accepted_verifiers`
2. reject_contradicted_claim — buyer claims `digital_capture` (non-AI) but attaches an asset URL with `ai-generated-true` → verifier returns `ai_generated: true` (confidence 0.95) → seller rejects with `PROVENANCE_CLAIM_CONTRADICTED` carrying audit-safe `error.details`
3. accept_consistent_claim — buyer claims `digital_capture` and asset URL has `ai-generated-false` → verifier confirms, accept

Validations check the full audit-safe `error.details` shape: `agent_url`, `feature_id`, `claimed_value: "digital_capture"`, `observed_value: true`.

Known issue — gated on a #3713 regression

The storyboard remains on `KNOWN_FAILING_STORYBOARDS` because of a pre-existing regression introduced by #3713 (training-agent v6 platform split): the `v6 SalesPlatform.syncCreatives` shim at `server/src/training-agent/v6-sales-platform.ts:173-179` invokes `handleSyncCreatives` with just `{ creatives }` and loses the brand/account context that session-keying depends on. The seeded `creative_policy` lives on one session key; the v6 shim's `handleSyncCreatives` looks at a different session key with no seeded products. Result: `aggregateCreativePolicy` returns null, no enforcement runs, every `sync_creatives` is accepted regardless of policy.

This breaks BOTH the existing `media_buy_seller/provenance_enforcement` (was passing pre-#3713) and the new `media_buy_seller/provenance_truth_of_claim`.

Local run on `creative` tenant:
```
media_buy_seller/provenance_enforcement ✗ 1P / 1F / 5S / 0N/A
× sync_creatives_no_provenance: Expected "failed", got "created"
media_buy_seller/provenance_truth_of_claim ✗ 1P / 1F / 2S / 0N/A
× sync_creatives_contradicted: Expected "failed", got "created"
```

The truth-of-claim contract code in this PR is correct — same root cause, same fix needed in the v6 shim. The minimum fix is to thread `brand` / `account` through the v6 platform call so `sessionKeyFromArgs` produces the same key the test-controller seeded against.

Test plan

• `npm run typecheck` clean
• `npm run build:compliance` clean (storyboard parses, build registers it)
• Truth-of-claim grades end-to-end — blocked on the feat(training-agent)!: migrate to @adcp/sdk@6.0.0 + split into per-specialism tenants #3713 v6-shim regression (above)
• Floor bumps for the affected tenant — defer until grading actually runs

Sequencing

This PR ships the wire contract and the test scaffolding; merging it doesn't claim conformance until the v6 shim is fixed. Merge order:

1. Land this PR (truth-of-claim handler + verifier + storyboard, KNOWN_FAILING entry kept)
2. Fix the v6 SalesPlatform.syncCreatives shim to thread brand/account
3. Remove the KNOWN_FAILING entry, bump floors, second PR with conformance proof

Filed/refs: #3802, #3713, #3468, #3777, #3792.

🤖 Generated with Claude Code