feat(compliance): add proposal_finalize_asap_timing storyboard scenario

[bokelley]

Refs #4401

Extends proposal_finalize coverage to test start_time: "asap" (the spec-defined string literal from start-timing.json) on create_media_buy. The existing scenario only exercised ISO date strings; this variant catches wrapper-layer rejections of the "asap" form before the handler runs.

Non-breaking justification: Additive new storyboard scenario file and two requires_scenarios list entries. No existing scenario, schema field, or step kind is renamed or modified. Per playbook, additive conformance harness scenarios are patch-eligible.

What changed:

• New file: static/compliance/source/protocols/media-buy/scenarios/proposal_finalize_asap_timing.yaml — mirrors the proposal_finalize phases but the accept_proposal step sends start_time: "asap" instead of an ISO date. io_acceptance is intentionally omitted to isolate the timing check from the IO-signing path (which is already covered by proposal_finalize). Response field checks are intentionally limited to response_schema — behavioral verification of the create_media_buy response is the parent scenario's job; this variant only confirms the input layer does not reject "asap".
• sales-guaranteed/index.yaml — added media_buy_seller/proposal_finalize_asap_timing to requires_scenarios
• sales-proposal-mode/index.yaml — same addition (specialism is deprecated in 3.1 per its narrative, but still active in 3.x)
• Changeset: patch

Note on {type: "asap"} object form: The issue body describes {type: "asap"} as an object form. That form is not in the spec: start-timing.json only allows the string "asap" or an ISO 8601 date-time string. The seller's Pydantic wrapper fix that widened signatures to accept the object form was defensive against out-of-spec buyer requests. This PR tests the spec-compliant string literal form only.

Note on "no dates / carry-forward" arm: The issue also mentions testing create_media_buy without explicit dates (carry-forward from proposal). This is not spec-valid: start_time and end_time are required[] unconditionally with no proposal-mode conditional. Whether to add one is a design decision for @bokelley — flagged as a follow-up.

Milestone routing gap: This is a patch changeset targeting the 3.0.x line (conformance harness addition is patch-eligible per playbook). No open 3.0.X patch milestone was found. Needs @bokelley to create one before merge, or redirect to 3.1.0 if preferred.

Pre-PR review:

• ad-tech-protocol-expert: approved — start_time: "asap" + ISO end_time is normatively valid; no cross-field constraint prohibits this combination; patch changeset is correct; io_acceptance removed per expert recommendation to avoid spurious failures on sellers without IO signing
• code-reviewer: approved (no blockers) — confirmed schema-valid wire shape, correct idempotency key seeds, correct id/category pattern, correct specialism index placement. Two issues fixed: removed "Wave 23.20" (possible real company name → rephrased to "an adopter"); added narrative note explaining intentionally sparse response validations.

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_01Ek4rwwuHRtRhDtNW6hxwac