fix(server): route update media buy handoffs through task registry

[bokelley]

Summary

• route updateMediaBuy task handoffs through the same framework registry path as createMediaBuy
• expose TaskHandoff<UpdateMediaBuyPayload> on the public SalesPlatform handler type
• preserve synchronous success and typed error-body behavior
• add caller-scoped polling coverage and a patch changeset

Root cause

createAdcpServerFromPlatform projected updateMediaBuy with projectSync
only. A handler could construct ctx.handoffToTask(...), but the runtime never
recognized the marker, registered its task, or assigned the framework-computed
owner scope. Polling then failed even though async update_media_buy is a legal
protocol path.

Upgrade warning

Adopters that manually called taskRegistry.create(...) as a workaround must
remove that code before upgrading. Running the workaround alongside the new
framework-owned handoff path can double-register work and emit duplicate
completion webhooks; there is no automatic deduplication between those paths.

Validation

• npm run build:lib
• npm run typecheck
• node --test-timeout=60000 --test-force-exit --test test/server-decisioning-from-platform.test.js (139 passed)
• npx prettier --check on all changed source/test/changeset files
• npx changeset status --since=origin/main
• pre-push validation hook

Fixes adcontextprotocol/adcp#5974.

[aao-secretariat]

Ladon verdict: Approve

Approve — routes update_media_buy task handoffs through the same routeIfHandoff seam as create_media_buy, widening SalesPlatform.updateMediaBuy to Promise<UpdateMediaBuyPayload | TaskHandoff>.

What I checked:

• Not spec drift: the SDK already ships UpdateMediaBuyAsyncSubmittedSchema and lists update_media_buy in SPEC_WEBHOOK_TASK_TYPES, so the submitted wire arm and completion webhooks are legitimate.
• Witness-not-translator preserved — no fabricated/normalized shapes at the seam.
• Sync-success, typed-error, and caller-scoped polling paths covered by new tests.
• Changeset present (.changeset/fix-update-media-buy-task-handoff.md).

Medium findings: None.

The only finding is Low (changeset typed patch for an additive capability), which is omitted from blocking consideration. No critical/high/medium findings, gated_paths is false, high_risk is false, no author-team gate. Rows 1–8 do not fire → row 9 approve.

Note (non-blocking): the changeset is typed patch for what is an additive async-handoff capability; a minor bump would be more accurate, though the change itself is sound.