feat(content-standards): deprecate inline asset credentials

[bokelley]

Summary

• deprecate inline service_account.credentials while keeping legacy 3.x payloads schema-valid
• recommend signed URLs as the default one-off asset-access path
• preserve credential-free workload identity and bounded bearer-token access
• define safe-fetch, redirect, credential-binding, and trusted-match fan-out boundaries
• add a tested 3.2 migration guide and focused regression coverage

Why

Standing cloud credentials embedded in artifact responses can flow through agent transport, logs, traces, and model context. AdCP 3.2 needs to stop new producers from emitting that pattern without breaking existing 3.x consumers before the 4.0 removal window.

This change deliberately does not add authorized_principal: payload metadata is not proof of authorization. The broader extensible and identity-bound access-method design is tracked in #6224, while removal of the deprecated field remains tracked in #5699.

Developer impact

• New producers should use short-lived signed URLs unless an identity-based relationship is already configured.
• Existing consumers must continue parsing and validating legacy inline credentials during 3.x, but may process them only for explicitly allowlisted legacy peers.
• service_account remains available without credentials for pre-authorized workload identity.
• Origins requiring an Authorization header can continue using short-lived, asset-scoped bearer tokens.
• Removal is eligible in 4.0 or later only after the six-month notice and full-release-cycle policy gates are satisfied.

Validation

• npm run test:schemas
• node --test tests/asset-access-deprecation.test.cjs
• npm run test:json-schema -- --file docs/reference/migration/asset-access.mdx
• npm run test:docs-nav
• node scripts/check-changeset-protocol-scope.cjs origin/main
• npx --yes @changesets/cli@^2.31.0 status --since=origin/main
• GitHub CI: all required checks passing, including CodeQL, security scans, build, integration tests, and current/3.0 storyboard matrices

Closes #5698.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema paths require human/CODEOWNERS approval.

This PR modifies static/schemas/source/** (the published protocol surface), which places it under the deterministic hard approval gate (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so per decision-table row 2 the outcome must be escalate rather than approve.

Reviewer found no code-correctness, spec-drift, changeset, or oneOf-discriminator issues: the deprecation of inline service_account.credentials is handled via a deprecated: true annotation while keeping the field schema-valid for the 3.x compatibility window, docs/release-notes/migration guide/changeset (minor) are coherent with the schema, the oneOf discriminator is intact, and no released dist/** artifacts are touched. The change reads as a non-breaking deprecation/clarification rather than a breaking-class change.

No blocking findings exist. The escalation is purely to satisfy the schema-source approval gate — a human/CODEOWNERS approval on the gated files (static/schemas/source/content-standards/artifact.json, static/schemas/source/trusted-match/context-match-request.json) lifts it.

Escalation reasons

• Modifies gated schema-source files under static/schemas/source/** while review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required before merge.

>

Why human review

• Modifies gated schema-source files (static/schemas/source/content-standards/artifact.json, static/schemas/source/trusted-match/context-match-request.json) under a hard approval gate while review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/content-standards/artifact.json (modified) matches static/schemas/source/**; static/schemas/source/trusted-match/context-match-request.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.