feat(decisioning): boot-time validator for declared idempotency vs wired @wrap

[bokelley]

Summary

Closes the silent-lie configuration where a platform advertises capabilities.adcp.idempotency.supported=True on the AdCP get_adcp_capabilities response but never applies @IdempotencyStore.wrap to any handler method. Buyers reading the capabilities envelope assume retries are deduped; without the decorator, every retry re-executes side effects.

• IdempotencyStore.wrap registers the wrapper in a private WeakSet (defense-in-depth over a spoofable sentinel attr)
• validate_idempotency_wiring fires from create_adcp_server_from_platform next to the existing property_list / webhook_sender / capabilities boot gates — AdcpError(recovery="terminal") on misconfig
• Loose check by design ("any method wrapped"). Tightening to per-method coverage requires the spec to expose a canonical mutating-tool enum, which AdCP #2315 doesn't yet
• Escape hatch: _adcp_idempotency_external = True on the platform class for adopters with upstream gateway dedup or BYO middleware the SDK can't introspect
• Error details carry candidate_methods, decorator_import path, and both opt-out flags so coding agents can auto-resolve the misconfig

Test plan

• 20 new tests in tests/test_validate_idempotency_wiring.py cover: is_wrapped semantics (incl. attr-spoofing rejection, bound-method resolution), capability reader (object-shaped capabilities, missing arms), validator units (no cap / unsupported / wrap-OK / async-but-unwrapped raises / external opt-out / property-with-boot-side-effect doesn't blow up the scan / dynamic bind in __init__), end-to-end through build_asgi_app (lying platform raises, honest platform boots, gateway-dedup platform boots)
• Adjacent suites green: tests/test_idempotency*.py, tests/test_decisioning_property_list.py, tests/test_decisioning_capabilities_submodule.py, tests/test_testing_decisioning.py (205 tests)
• Full unit suite green (3827 passed, 0 failures)
• ruff check + mypy clean on changed files

Reviewed by

Pre-PR review by code-reviewer, ad-tech-protocol-expert, dx-expert agents — all material concerns addressed in the final commit (WeakSet over attr sentinel, dir()+try/except over inspect.getmembers, escape hatch, error details for agents, real-async test coverage instead of lambdas).

🤖 Generated with Claude Code