feat(schema): add device platform exclusions

[bokelley]

Summary

Splits the ready part of #4239 into a focused 3.2 change: device_platform_exclude, the typed exclusion companion to existing device_platform.

This uses the canonical device-platform enum instead of adding a duplicate free-form os field. Exclusion wins on overlap, and sellers must reject constraints they cannot enforce rather than silently broaden delivery. Support remains implied by media_buy, matching existing device-platform capability semantics.

The custom-targeting half of #4239 is intentionally not included; it needs a separate capability-gated key taxonomy contract.

Refs #4239.

Validation

• Device-platform exclusion contract tests: 2 passed
• Changeset scope/status gates: passed
• git diff --check

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS approval.

This PR modifies static/schemas/source/core/targeting.json, which matches the repo's hard approval gate (static/schemas/source/**). gated_paths: true and review_decision: REVIEW_REQUIRED (not APPROVED), so decision-table row 2 fires: outcome MUST be escalate, not approve.

The change itself looks clean: it adds an optional additive device_platform_exclude field reusing the canonical device-platform enum via $ref, with exclude-wins / MUST-reject semantics. Schema↔docs coherence holds (targeting.mdx + get_adcp_capabilities.mdx updated), a changeset is present, and a contract test is included. The reviewer found no blocking or medium issues, and this is a Normative (non-breaking) additive change — so the Breaking-class hard gate does not independently trigger. But the deterministic gated-path gate is not satisfied absent an APPROVED review.

Escalation reasons

• static/schemas/source/core/targeting.json is under the hard approval gate (static/schemas/source/**); review_decision is REVIEW_REQUIRED, not APPROVED. Human/CODEOWNERS review is required before merge.

Why human review

• Modifies static/schemas/source/core/targeting.json — gated path requiring human/CODEOWNERS approval; review_decision is REVIEW_REQUIRED, not APPROVED
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/targeting.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[patmmccann]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 8faad5d3a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bokelley]

Superseded by #6203, which incorporates device_platform_exclude into the broader targeting-aware discovery model.

The combined version keeps the canonical enum, exclusion-wins rule, and reject-rather-than-drop behavior from this PR, while making exclusion support explicit per product through required_overlay_support.device_platform_exclude and overlay_support.device_platform_exclude. That avoids implying that every seller with the media-buy protocol supports platform exclusion.