Harden payment evidence and funded execution boundaries

[mizuki0x]

Summary

• define strict, canonical payment-intent, policy, and advisory-preflight contracts without presenting them as signer authorization
• park daemon-owned funded paths that lack exact one-use authorization and durable reservation: legacy x402, Hyre, Circuit, direct SAP, Metaplex/SNS writes, and automatic funded anchors
• tighten environment, signer, verifier-key, receipt-correlation, redirect, and publisher-key boundaries
• replace categorical identity, reputation, settlement, audit, sandbox, and W009/W011 claims with the exact implemented coverage
• add a repository guard that rejects the superseded public claims and requires the new boundary language

Boundaries

This is a hardening integration draft, not a production W009/W011 implementation.

• the published W009/W011 artifact remains a separate devnet reference harness in Add standalone devnet W009/W011 reference harness #129
• no production signer consumes an exact approver-signed one-use grant or complete typed input lineage
• authenticated peers can still request self-grants, and the identity-attestation route still signs bounded caller-supplied bytes
• Hermes and API-key AceData calls remain externally billed operations without durable monetary reservation
• the runtime remains trusted-local; same-user filesystem access is outside the process-level environment fixes
• retained lower-level payment and signer clients are development primitives, not daemon-reachable production paths
• the standalone MIP draft stays parked because official Metaplex agent validation and reputation programs already exist but are unfinished

The Base seller is also not production-ready: npm audit --omit=dev reports two affected production dependency nodes, one high and one moderate, through @coinbase/x402 -> @coinbase/cdp-sdk -> axios@1.16.0. The latest CDP SDK still pins that Axios version, and the automatic audit fix makes no change.

Smaller independently reviewable slices remain in #130 and #131. Rebase this integration branch after those land rather than merging duplicate hunks.

Validation

• ./agent-os/scripts/validate.sh --scripts
• cargo fmt --all -- --check
• cargo clippy -p covenantd --all-targets --locked -- -D warnings
• cargo test -p covenantd --lib --locked (866 passed)
• parked automatic Metaplex signer-spy integration (1 passed)
• affected Rust crate groups, including x402, Hyre, Circuit, MCP, SAP, Metaplex, and EVM signer
• landing tests (315 passed) and typecheck
• SAP bridge tests (67 passed) and typecheck
• witness-verifier tests (28 passed)
• seller-base tests (26 passed), typecheck, and build

npm audit --omit=dev remains an expected failing production gate for the upstream Axios dependency described above.