feat(creative): declare tracker execution contracts

[bokelley]

Summary

• add a format-option-scoped AdCP 3.2 production contract for first-class pixel_tracker, vast_tracker, and daast_tracker assets
• distinguish complete unsupported sets from incomplete/undeclared behavior, with exact event, actor, path, target, offset, and standards-version matching
• pin the effective product/placement contract, exact VAST/DAAST execution version, and RFC 8785 digests in immutable package format snapshots
• keep seller production authority out of creative-agent capability and legacy projection surfaces
• compose tracker initiation separately from feat(creative): define delivery representations and macro resolution #6767 macro processing and representation selection

Preview observation sessions and runtime evidence are intentionally excluded and remain AdCP 3.3 work in #6782. URL-slot tracker selectors are the independent 3.3 extension in #6784.

Stack

This PR is stacked on #6767 because tracker compatibility participates in representation-set selection. Retarget to main after #6767 merges.

Validation

• npm run build:schemas — 106 bundled schemas, zero failures
• npm run test:schemas
• npm run test:json-schema
• npm run test:compliance-snippets
• npm run test:error-code-drift
• npm run test:oneof-discriminators
• npm run test:schema-links
• node --test tests/tracker-execution-contracts.test.cjs tests/tracker-execution-package-integration.test.cjs tests/tracking-event-enums.test.cjs tests/creative-delivery-contracts.test.cjs tests/docs-nav-validation.test.cjs
• node scripts/check-changeset-protocol-scope.cjs origin/vast-creative-delivery-rules
• ad-tech, protocol, and code whole-diff review

Closes #6207
Related: #6775, #6783, #6782, #6784, #6767

[aao-secretariat]

Ladon verdict: Request changes

Request changes — 1 blocking finding.

Blocking findings

• static/schemas/source/core/assets/vast-tracker-asset.json:34 — GA-published vast_tracker/daast_tracker assets are narrowed against 3.1.19 (offset ignored→forbidden, new event/target matrix) via the new constraints files. This is a breaking wire change shipped under a minor changeset, which violates the repo's changeset-scope rule (breaking wire changes require major, not minor/patch). Either scope the changeset as major or avoid tightening validation on the already-published assets.

Medium findings

• static/schemas/source/core/canonical-format-option.json:45 — canonical-format-option adds a publisher_domain→format_option_id requirement (accept→reject), a validation tightening worth confirming is intended and non-breaking for existing payloads.

Row 1 of the decision table fires on the high finding, producing request-changes. Note: this PR touches gated paths under static/schemas/source/** with review_decision unknown/not APPROVED, and the reviewer flags a breaking-class change — both of which independently require human/CODEOWNERS review before merge. The schema modeling itself (discriminated tracker-execution-selector oneOf, immutable PackageFormatSnapshot with RFC 8785 digests, authority-stripping on projection surfaces) is clean and well tested; the blocker is the changeset-type/wire-compatibility mismatch on the GA-published tracker assets.

Blocking findings

• static/schemas/source/core/assets/vast-tracker-asset.json:34 — vast_tracker/daast_tracker GA assets narrowed (offset ignored→forbidden, new event/target matrix): breaking wire change vs 3.1.19 shipped under a minor changeset; requires major changeset or reverted tightening

Medium findings

• static/schemas/source/core/canonical-format-option.json:45 — canonical-format-option adds publisher_domain->format_option_id requirement (accept->reject)

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated paths not yet satisfied by human/CODEOWNERS review.

This is a subsequent pass. The prior request-changes blocking finding (vast/daast tracker assets narrowed against 3.1 GA under a minor changeset) has been resolved: the delta drops the whole-file constraints allOf and keeps only a local progress→offset requirement, restoring legacy-asset permissiveness, and new tests prove legacy assets/packages validate. The prior medium (canonical-format-option.json) file is out of the current delta and correctly skipped. No new blocking or medium findings this run.

However, this PR touches many files under static/schemas/source/**, which is a deterministic hard approval gate (gated_paths: true), and review_decision is CHANGES_REQUESTED — not APPROVED. Per decision rule row 2, the outcome must be escalate until a human/CODEOWNERS approval lifts the gate. No critical/high findings exist, so this is not request-changes; it is held for required human review only.

Escalation reasons:

• Gated paths touched (protocol schema source under static/schemas/source/**) and review_decision is CHANGES_REQUESTED, not APPROVED. Human/CODEOWNERS approval is required before merge.

Why human review

• Gated paths under static/schemas/source/** are modified/added and review_decision is CHANGES_REQUESTED (not APPROVED) — human/CODEOWNERS approval required to lift the hard approval gate (decision rule row 2).
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/assets/daast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/pixel-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/canonical-format-option.json (modified) matches static/schemas/source/**; static/schemas/source/core/daast-tracker-constraints.json (added) matches static/schemas/source/**; static/schemas/source/core/format.json (modified) matches static/schemas/source/**; static/schemas/source/core/package-format-snapshot.json (added) matches static/schemas/source/**; static/schemas/source/core/package.json (modified) matches static/schemas/source/**; static/schemas/source/core/product-format-declaration.json (modified) matches static/schemas/source/**; static/schemas/source/core/representation-destination.json (modified) matches static/schemas/source/**; static/schemas/source/core/representation-rejection.json (modified) matches static/schemas/source/**; static/schemas/source/core/representation-selection.json (modified) matches static/schemas/source/**; static/schemas/source/core/requirements/daast-asset-requirements.json (modified) matches static/schemas/source/**; static/schemas/source/core/tracker-execution-contract.json (added) matches static/schemas/source/**; static/schemas/source/core/tracker-execution-selector.json (added) matches static/schemas/source/**; static/schemas/source/core/transformer.json (modified) matches static/schemas/source/**; static/schemas/source/core/vast-tracker-constraints.json (added) matches static/schemas/source/**; static/schemas/source/core/x-entity-types.json (modified) matches static/schemas/source/**; static/schemas/source/enums/pixel-tracking-event.json (added) matches static/schemas/source/**; static/schemas/source/enums/tracker-execution-actor.json (added) matches static/schemas/source/**; static/schemas/source/enums/tracker-firing-path.json (added) matches static/schemas/source/**; static/schemas/source/formats/canonical/audio_daast.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/media-buy/get-media-buys-response.json (modified) matches static/schemas/source/**; static

…(truncated)…