feat(adcp): force_create_media_buy_arm + force_task_completion controller scenarios

[bokelley]

Closes #97

Adds force_create_media_buy_arm (adcp#3104) and force_task_completion (adcp#3138) to adcp/testcontroller.go, giving the Go reference seller storyboard parity with the training-agent implementations at adcp#3115 and adcp#3194.

What changed

force_create_media_buy_arm — registers a single-shot per-principal directive that drives the next create_media_buy call into submitted or input-required arm. Validates arm enum using TaskStatusSubmitted/TaskStatusInputRequired constants, task_id requirement (submitted arm only), and byte-length caps (task_id ≤128 B, message ≤2000 B). Returns ForcedDirectiveSuccess.

force_task_completion — resolves a submitted task to completed. Validates task_id (≤128 B), result is non-empty object, encoded size ≤256 KB. Re-marshals from map[string]any to json.RawMessage before the size check for stable opaque payload passing. Returns StateTransitionSuccess from types_gen.go (includes message, context, ext fields the storyboard harness validates against).

Sandbox bool guard — RegisterTestController panics at startup if store.Sandbox is false, providing runtime enforcement of the existing "MUST NOT register in production" contract. Mirrors the buildCapabilities startup-panic pattern.

ForcedDirectiveSuccess type — hand-written and registered in both KNOWN_TYPES (generate.py) and EXEMPT (lint.py). Comment notes the pending upstream schema in adcp#3104 so the bundle-bump owner knows to check for drift when the version pin moves past 3.0.0.

Both scenarios advertised in list_scenarios when store functions are wired.

Cross-account isolation, single-shot consumed-and-cleared semantics, and idempotency are seller responsibilities (consistent with every other force_* scenario in the existing dispatch layer).

Caveats: buyer-side tasks/get polling round-trip is deferred pending adcp-client#994. This PR ships the controller-side primitive only; storyboard runners mark the buyer-side polling scenario not_applicable until that lands.

What was tested

• go build ./... ✓
• go vet ./... ✓
• cd adcp && go test ./... ✓ — all packages including 10 new tests:
  • TestForceCreateMediaBuyArm_Submitted
  • TestForceCreateMediaBuyArm_InputRequired
  • TestForceCreateMediaBuyArm_InvalidParams (5 sub-cases: missing arm, invalid arm, submitted without task_id, task_id too long, message too long)
  • TestForceTaskCompletion_Valid
  • TestForceTaskCompletion_InvalidParams (5 sub-cases: missing task_id, task_id too long, missing result, empty result, result not object)
  • TestForceTaskCompletion_NotFound
  • TestForceTaskCompletion_InvalidTransition
  • TestRegisterTestController_SandboxGuard
  • TestListScenarios_IncludesNewScenarios

Pre-PR review

• code-reviewer: approved — no blockers; bytes-vs-chars clarification and panic guard test addressed in fixup commit
• ad-tech-protocol-expert: approved — wire format correct (StateTransitionSuccess for force_task_completion), arm enum values match A2A/AdCP vocab, deferred buyer-side polling does not create a conformance gap

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See adcp#3121
for context.

Session: https://claude.ai/code/session_01Js7WwyJontwvwN6G5Um1Z3

---

Generated by Claude Code