Sweep dependencies and bump to 2.12.1

[vvillait88]

Summary

Dependency sweep for node-commerce, plus the release bump to 2.12.1.

• @agent-score/sdk floor ^2.7.10 to ^2.7.11, the release published earlier in this sweep. It is the package's one runtime dependency, so merchants installing 2.12.1 get it.
• Coupled-set pins: mppx 0.9.2 to 0.9.3 and viem 2.56.3 to 2.56.5, in both the dev pin and the single-version viem override. The Tempo zero-amount proof EIP-712 domain in dist/tempo/internal/proof.js is still version '3' in 0.9.3, so agent and verifier cannot disagree on it. The 0.9.3 changes on this package's import path (mppx/server, root mppx) are additive: challenge context on payment-success hooks, a fee-payer policy option that allows sponsorship by default, Stripe PaymentIntent metadata, and patched fast-uri/qs. mppx 0.9.3's peers (viem >=2.54.0, @x402/core >=2.22.0, hono >=4.12.25, express >=5) all resolve satisfied, and the lock holds one viem copy.
• The osv-scanner binary the Dependency Scan job downloads moves from v2.5.1 to v2.6.0, a workflow input dependabot never proposes.
• CLAUDE.md's "Dev: linked sdk" note said the dependency is link:@agent-score/sdk; it has been a registry range, so the note now says how to link temporarily and restore.
• chore(deps): bump the minor-patch group with 5 updates #128 (merged before this) already took @solana/kit 8.3.0, fastify 5.12.4 and dev tooling into the lock.

Override drill, each removed alone from a clean install: axios ^1.18.0 is load-bearing (cdp-sdk's exact 1.16.0 returns without it), esbuild ^0.28.1 is load-bearing (0.27.7 returns), viem resolves identically without it today and stays as the coupled set's single-version discipline.

Checked and found current: @x402/core/evm/extensions 2.25.0 and @solana/mpp 0.7.0 are upstream latest (exact pins, which bun outdated cannot show); every Action is on its latest release-tag major; bun 1.4.2; dependabot config (held majors scoped, coupled pins blanket-ignored by design); hook/CI parity. A nested @solana/kit 5.5.1 under dev-only @coinbase/cdp-sdk predates this change.

Not taken: eslint 10 and TypeScript 7 (org-wide holds), lefthook 2.1.14 (inside the 24h release-age soak).

Still owed, and sequenced rather than dropped: the holds registry requires a live Base, Tempo and Solana settle after a coupled-set bump. It needs pay on mppx 0.9.3 paying a storefront running 2.12.1, so it runs at the storefront stage of this sweep.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported type, signature, or wire shape changed.

Test plan

From a clean bun install --frozen-lockfile: bun run lint, bun run build, bun run typecheck (source and examples), bun run knip, bun run test with coverage (119 files, 1825 passed, 4 skipped), all exit 0. osv-scanner 2.6.0 over bun.lock: 899 packages, no issues.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

Worked with Varun. The tag follows the merge.