fix(compliance): extend $generate:uuid_v4 to all hardcoded idempotency_keys in media-buy storyboards

[bokelley]

Closes #4230

Summary

Extends the $generate:uuid_v4#<alias> pattern to all 15 remaining hardcoded idempotency_key literals across 9 media_buy_seller storyboard scenarios. Follows the precedent set in #4218 (merged today), which fixed measurement_terms_rejected.

Root cause: Hardcoded keys collide cross-run when a seller's IdempotencyStore is long-lived. The runner shifts start_time forward to keep buys future-dated, so each run produces same key + different canonical body → seller correctly replays a stale cached response. This blocks conformance scenarios whenever the seller ships a spec-version upgrade that changes its response shape.

Files changed: 9 storyboard scenario YAML files under static/compliance/source/protocols/media-buy/scenarios/.

Also included: Renames 3 pre-existing aliases in governance_denied.yaml (line 191) and invalid_transitions.yaml (lines 76, 194) that used bare names (governance_denied_create_media_buy, update_unknown_media_buy, update_unknown_package) instead of the established media_buy_seller_<scenario>_<phase>_<step> convention. Caught by the code-reviewer in pre-PR pass.

Not in scope: measurement_terms_rejected.yaml and provenance_enforcement.yaml still have non-prefixed aliases (pre-existing, pre-date the naming convention). Left as follow-up to avoid scope creep.

Non-breaking justification

Storyboard YAML files are conformance test harness configuration, not published protocol schema. No wire format, task definition, schema field, or normative requirement is changed. The $generate:uuid_v4#alias token is runner-internal and never transmitted to a seller. Per playbook "Conformance harness" — additive or fix changes are --empty (no protocol bump).

Build

npm run build:compliance passes with all 12 storyboard lints green:

✓ scoping lint ✓ branch-set lint ✓ provides_state_for lint
✓ contradiction lint ✓ context-entity lint ✓ auth-shape lint
✓ test-kits lint ✓ pagination-invariant lint ✓ vendor metric uniqueness lint
✓ check-enum lint ✓ raw-mode-required lint ✓ advisory-expiry lint
✅ 23 universal, 6 protocols, 20 specialisms

Pre-PR review

• code-reviewer: approved — all 15 keys covered, aliases unique (53/53), convention consistent, --empty correct. Noted measurement_terms_rejected / provenance_enforcement pre-existing non-prefixed aliases are out of scope for this PR.
• ad-tech-protocol-expert: approved — non-breaking per spec, sync_plans dynamic key is sound (governance agent upserts on plan_id deterministically regardless of key), --empty changeset classification is correct per playbook.

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_016efYC8QLXVZZSPiisZ83oM

---

Generated by Claude Code