feat(schema): add object-form timing union to start_time/end_time (create_media_buy / update_media_buy)

[bokelley]

Refs #4400

Production (v3.2.4, master de58207) already accepts {"type":"asap"} and {"type":"scheduled","time":"..."} object forms alongside legacy ISO 8601 strings for start_time (since Wave 23.9) and end_time (since Wave 23.20). The JSON schemas were not updated at the time. This PR brings the schemas in sync with production behavior so seller implementers reading the spec don't hit the same asymmetry the reporter did.

Changes:

• core/start-timing.json — extended from 2 string variants to 4: adds {"type":"asap"} and {"type":"scheduled","time":"..."} object forms alongside the existing "asap" string and ISO 8601 string (legacy forms preserved).
• core/end-timing.json (new) — two variants: ISO 8601 string (legacy) + {"type":"scheduled","time":"..."} object form. The asap variant is intentionally absent — end_time must be a determinate future point for billing and pacing to close correctly (per protocol-expert and product-expert review; "asap" end has no defined semantics in any major ad platform).
• create-media-buy-request.json, update-media-buy-request.json — end_time changed from inline type:string to $ref: /schemas/core/end-timing.json.
• index.json — end-timing.json registered; start-timing description updated.

Normalization contract: Sellers MUST resolve object-form timing to an ISO 8601 datetime before storing. get_media_buys responses return the resolved string form (response schemas unchanged — this is an input-only widening).

Non-breaking justification: All previously-valid string values continue to validate under both updated schemas. The change is purely additive (new accepted oneOf branches; no existing branch removed, renamed, or tightened). Changeset: minor.

Known follow-on (out of scope for this PR): Package-level start_time/end_time in package-request.json and package-update.json carry the same schema gap (plain type:string). If production also accepts object-form timing at the package level, a follow-up PR should extend those schemas consistently. Filed as a nit in the pre-PR review.

Pre-PR review:

• code-reviewer: approved — blocker fixed (end-timing.json now registered in index.json); nit on normative MUST language in description (accepted as non-normative hint); no structural issues
• ad-tech-protocol-expert: approved — additionalProperties: false per variant is correct; asap exclusion from end-timing is correct per GAM/TTD/DV360 precedent; index registration blocker fixed; minor changeset classification confirmed correct

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_01Ku28c7vQReEY8FY2iHFcCW

---

Generated by Claude Code