compliance(media-buy): available_actions should be runnable by sales-non-guaranteed-only sellers

[fgranata]

Problem

Follows the same root cause as the base media_buy_seller flow fix (recently merged): available_actions.yaml seeds a guaranteed-only product fixture (available_actions_display, delivery_type: guaranteed). A seller declaring only specialisms: ["sales-non-guaranteed"] correctly rejects a guaranteed buy with a terminal DELIVERY_MODE_NOT_SUPPORTED, so create_buy_from_product fails and the whole enforcement flow (read_persisted_buy_actions, enforce_available_actions) cascades as prerequisite_failed.

Change

Switch the fixture to non_guaranteed (fixed_price → floor_price). The allowed_actions behavior this scenario actually grades (self-serve vs requires-approval action enforcement) is delivery-type-agnostic, so nothing about the test's intent changes. The create steps reference the product/pricing by id, unchanged.

Reproduction

Against a live sales-non-guaranteed seller, media_buy_seller/available_actions → create_buy_from_product returns DELIVERY_MODE_NOT_SUPPORTED (terminal) → downstream steps prerequisite_failed.

Scope note for maintainers

This is the second incidental guaranteed-only fixture (after the base flow). I found 8 other media-buy scenarios that also seed delivery_type: guaranteed (billing_finality_delivery, create_media_buy_async, measurement_accountability, vendor_metric_accountability, delivery_reporting, canonical_formats, get_products_async, governance_approved). I deliberately did not touch those — some likely test guaranteed-specific behavior on purpose (e.g. governance_approved's IO-approval, the async arms) and should stay guaranteed + be capability-gated rather than flipped. Happy to follow up per your guidance on which are incidental vs intentional.

Source-only change; the packaged dist/compliance/ cache is generated by the build.

🤖 Generated with Claude Code

[aao-release-bot]

⚠️ Argus review could not complete

The automated review encountered an issue (possibly reached max turns, timed out, or failed to post the final gh pr review). A human reviewer should take this PR.

View workflow run

_{This is an automated message from the Argus AI review workflow.}