feat(brand): link voice synthesis to rights offerings

[bokelley]

Summary

Adds the one remaining brand-side join for voice rights provenance: optional voice_synthesis.rights_offering_id on get_brand_identity.

The field identifies the configuration-time offering returned by get_rights. It is deliberately not named rights_id, because the buyer-specific grant does not exist until acquire_rights. It remains advisory provenance; synthesis authorization stays in generation_credentials, and serve-time revocation stays in rights_constraint.verification_url.

The transformer-side voice_synthesis_ref[].rights_id description now makes the join explicit: it may carry the offering anchor or the later buyer-specific grant after provisioning.

Closes #5261.

Impact

• Existing responses remain valid; the new field is optional.
• Buyers can trace brand voice configuration → rights offering → acquired grant → provisioned transformer without a new build-time gate.
• Carries a minor protocol changeset for the additive stable-schema field.

Validation

• Context-entity lint: 14 passed
• Source schema structure validation reached all 660 schemas with the new field accepted
• Changeset scope and status gates pass
• git diff --check

[aao-secretariat]

Medium: The description calls this "configuration-time advisory provenance," but the field is added only to the response schema — brand.json's voice_synthesis (static/schemas/source/brand.json:571) still lists just provider/voice_id/settings. get_brand_identity.mdx:193 states the response "mirrors the brand.json brand definition, extended with dynamic data." If rights_offering_id is genuinely configured on the voice, it belongs in brand.json too, for symmetry with where the voice is defined; if it is instead a response-time annotation the agent resolves, "configuration-time" is the wrong framing. additionalProperties: true on both keeps this from breaking the wire — hence Medium, not blocking — but the two source schemas disagree on whether this field exists.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path touched without required approval.

This PR adds the optional voice_synthesis.rights_offering_id provenance pointer to the brand-identity response schema, documents it in get_brand_identity.mdx and the buyer-attached-inputs note, and clarifies transformer.json's rights_id description. The change is additive/Normative (non-breaking), the minor changeset is correct, and additionalProperties: true preserves compatibility. Schema and docs are internally coherent — no spec drift.

Why escalate: The diff modifies files under static/schemas/source/** (get-brand-identity-response.json and transformer.json), which are under the deterministic hard approval gate (gated_paths: true), and review_decision is REVIEW_REQUIRED — not APPROVED. Per decision rule row 2, this requires human/CODEOWNERS review before it can proceed. The gate lifts once a reviewer approves.

Medium findings (non-blocking, for the human reviewer's attention):

• static/schemas/source/brand/get-brand-identity-response.json:403 — rights_offering_id is described as configuration-time provenance but was added only to the response schema, not to brand.json where voice_synthesis is defined. Worth confirming this placement is intentional.

Escalation reasons:

• static/schemas/source/brand/get-brand-identity-response.json (modified) and static/schemas/source/core/transformer.json (modified) are gated schema-source files; review_decision is REVIEW_REQUIRED, so human/CODEOWNERS approval is required before merge.

Medium findings

• static/schemas/source/brand/get-brand-identity-response.json:403 — rights_offering_id added to response schema but not brand.json voice_synthesis

Why human review

• Modifies gated schema-source files (static/schemas/source/brand/get-brand-identity-response.json, static/schemas/source/core/transformer.json) while review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required (decision rule row 2).
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/brand/get-brand-identity-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/transformer.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.