feat(agentkit): add Agent Guild trust and payment safety provider

[AgentTanuki]

Description

Adds a TypeScript agentGuildActionProvider that lets wallet-bearing AgentKit agents quote and purchase Agent Guild trust and payment-safety decisions before delegation or payment.

The provider exposes four explicit actions:

• quote_agent_trust and purchase_agent_trust
• quote_payment_safety and purchase_payment_safety

Safety properties:

• Quote actions never pay.
• Purchase actions require the exact prior x402 v2 option plus confirmPayment: true.
• The live 402 is re-fetched and must still match the selected scheme, Base mainnet network, Base USDC asset, amount, payee, timeout, extra fields, and exact resource URL before a payment payload can be created.
• The provider uses the official @x402/fetch and @x402/evm client paths with both a registered payment policy and a final pre-signing hook.
• maxPaymentUsdc is a hard per-request ceiling and defaults to 0.01 USDC.
• An overridden Agent Guild base URL is quote-only unless the developer explicitly enables payments to it; the model cannot change either constructor option.
• Post-signing transport failures report settlement as unknown rather than claiming no payment occurred.

The default hosted service requires no Agent Guild account or API key. The provider supports Base mainnet EVM wallets.

Tests

• Full @coinbase/agentkit test suite: 62 suites, 875 tests, 0 failures.
• Scoped TypeScript typecheck, ESLint, and Prettier checks passed.
• Provider tests cover quote-only behavior, exact request bodies, wrong-token and over-cap filtering, hard-cap enforcement, direct-call confirmation enforcement, custom-root quote-only behavior, live-quote drift and resource-drift aborts, Base-only support, and honest unknown settlement reporting.
• The official @x402/fetch interoperability test creates a test-only EIP-3009 payload entirely offline, checks the exact accepted/resource fields, and parses a mock settlement receipt. It uses no funds and makes no payment.
• A live direct-action quote-only check against Agent Guild returned payment_required, paid: false, 10,000 atomic units of Base mainnet USDC, and the exact treasury payee. It created no signature and made no payment.

No model-backed chatbot test was run because no model API key is available in this environment. No live paid test was run; no funds were used.

Checklist

• Added documentation to all relevant README.md files
• Added a changelog entry
• All commits are GitHub-verified

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1