Sweep dependencies and bump to 0.5.6

[vvillait88]

Summary

Dependency sweep for pay, plus the release bump to 0.5.6.

• @agent-score/sdk floor ^2.7.10 to ^2.7.11 (published earlier in this sweep) and @clack/prompts 1.8.0 to 1.8.1.
• Coupled-set pins: mppx 0.9.2 to 0.9.3 and viem 2.56.3 to 2.56.5, in both the dependency and the single-version viem override, matching node-commerce 2.12.1 (released today). pay constructs only tempo({ account }) from mppx/client; in 0.9.3 the Tempo proof EIP-712 domain in dist/tempo/internal/proof.js is still version '3', and the only Tempo client file that changed is Subscription.js, which pay does not use. mppx's viem >=2.54.0 peer is satisfied and the lock holds one viem copy.
• The osv-scanner binary the Dependency Scan job downloads moves from v2.5.1 to v2.6.0.
• chore(deps): bump the minor-patch group with 3 updates #110 (merged before this) already took @solana/kit 8.3.0 and dev tooling.

Override drill, each removed alone from a clean install: esbuild ^0.28.1 is load-bearing (0.27.7 returns), viem resolves identically without it and stays as the coupled set's single-version discipline. The incur@0.5.1 patch is still needed (upstream 0.5.1 still routes the MCP transport through the importModule indirection), still applies, and carries no local paths.

Checked and found current: the exact pins bun outdated cannot show (@x402/core/evm/fetch 2.25.0, incur 0.5.1, @solana/mpp 0.7.0, @solana-program/system 0.14.1, @solana-program/token 0.16.1) and the remaining caret deps; every Action on its latest release-tag major; sigstore/cosign-installer v4.1.2 is upstream latest; bun 1.4.2; dependabot config; hook/CI parity.

Not taken: eslint 10 and TypeScript 7 (org-wide holds), lefthook 2.1.14 (inside the 24h release-age soak).

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No command, flag, or output envelope changed.

Test plan

Gates, from a clean install: bun run lint, typecheck, knip, build, test -- --coverage (57 files, 577 passed, 2 skipped), all exit 0. osv-scanner 2.6.0 over bun.lock: 682 packages, no issues.

Compiled binary (the incur serveCli protocol): build:binary:darwin-arm64 builds, --version reports the injected 0.5.6, and an MCP initialize plus tools/list handshake over stdio against the binary returns serverInfo agentscore-pay 0.5.6 and the discovery tools (search_tools, get_tool_details, call_read_tool, call_write_tool).

Live settles with this branch's build against the fullenrich storefront (which still runs the previous node-commerce), smoke wallet:

Rail	Ungated /company/lookup	Gated /person/enrich/work-email (KYC)
Base (x402)	200, charged $0.02, completed	200, charged $0.07, completed
Tempo (MPP)	200, charged $0.02, completed	200, charged $0.07, completed
Solana (MPP)	402 payment_proof_invalid	not attempted

Solana is not exercised: the smoke wallet holds 0 USDC on Solana. The released 0.5.5 returns the identical payment_proof_invalid for the same request, so the failure is the unfunded wallet, not this change. A Solana settle is still owed once the wallet is funded.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

Worked with Varun. The tag follows the merge; the release also updates the Homebrew tap, and the fleet's pinned pay version moves in the hivemind afterwards.