chore(deps): update @adcp/sdk to 13.0.0

[bokelley]

Summary

• replace the @adcp/sdk 13.0.0 release candidate with the 13.0.0 GA package
• refresh the lockfile to the published GA tarball and integrity hash
• register the published 3.1.15 compliance cache as package-only on main

Why

SDK 13.0.0 is now the published latest release and contains the finalized AdCP 3.2 proposal-negotiation primitives used by the training profiles.

The GA package also exposes the 3.1.15 maintenance cache. Its generated release files remain on the maintenance branch, so the publication manifest records it as package-only rather than forwarding those artifacts into main.

Validation

• npm run typecheck
• npm run test:sdk-shims
• node --test tests/proposal-negotiation-guide.test.cjs
• npx vitest run server/tests/unit/proposal-negotiation-profiles.test.ts --pool=threads
• npm run check:published-compliance
• node --test tests/published-compliance-versions.test.cjs
• node scripts/run-test-stage-shard.mjs --shard 3/4 --exclude test:server-unit (with CI placeholder credentials)
• git diff --check

[aao-secretariat]

Ladon verdict: Approve

Approve — RC→GA dependency bump.

Only package.json and package-lock.json change: @adcp/sdk moves 13.0.0-rc.26 → 13.0.0, with the lockfile refreshed to the GA tarball URL, resolved URL, and integrity hash. The lockfile is internally consistent.

@adcp/sdk is a consumed dependency, not the published protocol surface (static/schemas/source/**), so no changeset is required and the package version (3.1.1) is untouched. No schema, docs, dist artifact, or migration files touched.

No blocking findings, no medium findings. Not gated (gated_paths: false), no high-risk paths, no author team gate. Falls through to row 9.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean version-registration delta with no blocking findings.

This PR bumps the SDK to 13.0.0 GA and registers "3.1.15" as a package-only compliance version in static/compliance/published-versions.json, alongside the corresponding package.json/package-lock.json changes. The reviewer confirmed the new entry is valid semver, does not overlap published_versions (which stops at 3.1.13), correctly uses the package-only lane so the check-published-compliance gate accepts the GA tarball's 3.1.15 cache without requiring dist artifacts in main, and is consistent with the existing 3.2.0 handling.

No schema (static/schemas/source/**) changes, no docs coherence concern, no dist immutability violation, no changeset scope issue, no oneOf discriminator regression. No findings of any severity.

Decision table: no critical/high (row 1 n/a); gated_paths false (row 2 n/a); high_risk false (rows 3/5 n/a); no medium findings (rows 4/8 n/a); prior decision was approve (row 6 n/a); no no-auto-approve team match (row 7 n/a). Falls through to row 9 → approve. This is a net-clean subsequent pass over the prior approve.

[aao-secretariat]

Re-approval: no reviewable delta since the prior approval; re-submitting after stale-review dismissal.