feat: add a post-transaction dispute resolution sample

[maximusrufus]

Description

Adds a stdlib-only sample under code/samples/python/scenarios/dispute/ showing what happens after an AP2 flow completes and the parties disagree, where the disagreement is not fraud.

The resolver reads only artifacts a completed flow already leaves behind — the checkout mandate hash, the payment mandate, both receipts, and the order record. It:

1. verifies the authorization chain binds (payment_mandate.transaction_id and both receipts' reference against the closed checkout mandate's checkout_hash). A chain that does not bind is an authorization question, so the sample declines it and routes it to the network fraud process rather than deciding it;
2. where the chain holds, decides performance per line;
3. emits a determination with per-line outcomes and amounts, the factors considered, a signer-of-record slot, a loser-pays fee disposition, and a content-hash seal.

Scenario. A shopping agent completed a human-not-present purchase of 4 units under a signed Payment Mandate. The merchant issued Success receipts. The order record shows 1 of 4 units fulfilled and the merchant's own estimated_delivery window has passed with no adjustment.

Run it.

python code/samples/python/scenarios/dispute/resolve_dispute.py \
  code/samples/python/scenarios/dispute/dispute_record.json --now 2025-10-24

Line line_item_456 is overturned for 7500 minor units, fee paid by the merchant. Tamper with payment_mandate.transaction_id and the same command returns not_eligible: authorization_chain_broken with route: network fraud process.

Why it might be useful here. The point is narrow: the AP2 trail is sufficient evidence for a neutral third party to resolve non-fraud disputes without any data the protocol does not already emit. The sample names no provider and takes no position on who should run a resolver.

Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Follow the CONTRIBUTING Guide.
• Make your Pull Request title in the https://www.conventionalcommits.org/ specification.
• Ensure the tests and linter pass — ruff passes under this repo's .ruff.toml (Google style, 80 columns) and cspell passes under .cspell.json. The sample runs clean from the repo root. The Lint Code Base job is red on a BIOME_LINT failure that predates this PR: the same failure appears on unrelated open PRs, and that job's FILTER_REGEX_EXCLUDE skips code/samples/, so it is not evaluating anything added here. Happy to rebase once it is green on main.
• Appropriate docs were updated (if necessary) — the sample ships its own README; no existing docs needed changes.

Two notes for reviewers:

• No API key and no third-party dependency; Python standard library only.
• ATDRP and unassessable were added to .cspell/custom-words.txt, inserted in place without reordering the existing entries.
• Happy to move, rename, or restructure the scenario directory if code/samples/python/scenarios/dispute/ is not where you would want it.

Fixes #N/A — new sample, no linked issue. 🦕

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[maximusrufus]

@googlebot I signed it!

[maximusrufus]

The BIOME_LINT failure on this PR comes from pre-existing errors in code/web-client/src and docs/assets/mandate_delegation_user_credential.svg, none of which this PR touches (it only changes the Python dispute sample, its README/JSON, and the cspell word list). The same check is failing across unrelated PRs. #382 fixes those errors; once it merges, a re-run here should go green.