fix(comply): autodetect webhook_receiver requirement from token presence

[bokelley]

Closes #1678. Part of the coordinated stance at #1685.

Summary

comply() was shipping the literal mustache token {{runner.webhook_url:<step_id>}} on the wire whenever a webhook-emitting storyboard ran without a configured receiver. 3.0-strict sellers (Wonderstruck) correctly reject the resulting payload as INVALID_REQUEST: Input should be a valid URL, relative URL without a base, cascading 5 distinct first-step failures across webhook_emission/* and idempotency/replay_same_payload.

The spec already answers what should happen:

• compliance/{version}/universal/webhook-emission.yaml L34: "grades not_applicable when the runner does not host a webhook receiver"
• L62–70 (prerequisites): "Runners without a receiver grade this universal as not_applicable"
• L331–332 (grading): "Runners without a webhook receiver grade the entire universal as not_applicable"

So the SDK's job is to grade not_applicable, not to placeholder a fake URL. The triage thread on #1678 considered synthesizing https://aao.test/sink/... and rejected it — that would let signature_validity vacuously pass against a sink that never responds, which is exactly the false-certification failure mode #1685 is rejecting.

What changed

1. RequirementName — extended with 'webhook_receiver'; added to KNOWN_REQUIREMENTS.
2. REQUIREMENT_TO_SKIP_REASON — maps 'webhook_receiver' → 'requirement_unmet'.
3. checkRequires() — detects options.webhook_receiver === undefined and returns a structured unmet requirement with a helpful detail message.
4. detectImplicitRequires(storyboard) — new helper that recursively scans every step's sample_request for {{runner.webhook_url:<step_id>}} or {{runner.webhook_base}} tokens and returns ['webhook_receiver'] when any are found. Token presence IS the declaration.
5. Gate — unions declared (storyboard.requires) and implicit requirements before calling checkRequires.

Why autodetection, not a requires: retag

The triage thread proposed two options:

• Option 1 (synthesize an absolute placeholder URL): out — makes signature_validity vacuously pass against a sink that never responds. False certification claim.
• Option 2 (extend RequirementName with 'webhook_receiver' and tag storyboards): correct, but requires every webhook storyboard YAML in adcontextprotocol/adcp to be retagged AND new ones to remember the tag.

This PR takes the third path: option 2's runtime, with autodetection driving the requirement. Authors don't write requires: [webhook_receiver] — the existing {{runner.webhook_url:…}} token in their sample_request already declares the dependency. New webhook scenarios inherit the gate automatically.

The loader still accepts an explicit requires: [webhook_receiver] (the new test confirms this) for authors who want belt-and-suspenders, but no spec change is required.

What was tested

• 5 new tests in test/lib/storyboard-requires-gate.test.js:
  • {{runner.webhook_url:…}} tokens trigger the gate (no receiver → requirement_unmet:webhook_receiver)
  • {{runner.webhook_base}} tokens trigger the gate
  • Storyboards with NO webhook tokens are unaffected
  • Deep-nested tokens (under arrays + objects) are still detected by the recursive scan
  • Loader accepts explicit requires: [webhook_receiver]
• All existing requires-gate tests still pass.
• npx tsc --noEmit --project tsconfig.lib.json — clean.
• npx prettier --check — clean.

Coordination

Merge order (#1685):

1. fix(comply): forward structured adcp_error from failed storyboard steps #1684 (1679 keystone — adcp_error forwarding) — ships first, makes wire-level errors observable
2. fix(client): remove account_from_brand fabrication shim in normalizeRequestParams #1683 (1676 — account_from_brand removal) and fix(normalizer): fail closed on pre-3.0 PackageRequest shapes #1681 (1677 — package normalizer fail-closed) — fabrication twins
3. fix(conformance): grade storyboards not_applicable when required_tools are missing #1682 (1680 — not_applicable routing for missing required_tools)
4. This PR — autodetect webhook_receiver. Lands last; logically depends on fix(conformance): grade storyboards not_applicable when required_tools are missing #1682's not_applicable plumbing for grader-side surfacing.

🤖 Generated with Claude Code

[bokelley]

Tracking under #1685 — hat 3 of 5 (literal mustache tokens escaping). Do not merge before #1684 or #1682. Logically depends on #1682's not_applicable routing for grader-side surfacing of the new requirement_unmet:webhook_receiver skip.

[bokelley]

Acknowledged — merge order noted: #1684 first, then #1682, then this PR. No code changes needed; the dependency is a sequencing constraint, not a diff issue.

---

Generated by Claude Code