feat: gate machine payments by signed wallet identity

[AgentTanuki]

Why

Crypto-capable agents need a counterparty decision at the wallet they are about to fund, not only at a mutable agent id. This makes an exact (EVM address, CAIP-2 network) binding resolvable and offline-verifiable, then supplies a fail-closed adapter for the Virtuals ACP funding boundary proposed in Virtual-Protocol/acp-node-v2#39.

What

• adds free exact wallet-binding resolution with active-status evidence
• issues a Guild-signed binding credential over the DID, EVM address, and network
• verifies dual DID + EVM wallet-control proofs
• exposes the paid risk-score step only after the free identity resolution
• ships a fail-closed Virtuals ACP fundPolicy adapter in SDK and hosted artifacts
• requires explicit allow; denial, missing evidence, verifier failure, amount mismatch, wallet mismatch, or network mismatch stops funding
• updates the machine contract, interface docs, and agent-facing integration guidance

Validation

• focused Python coverage: 18 passed, 1 skipped
• Node adapter test passed
• full JSON matrix: 1,418 passed, 12 skipped, 1 baseline-known test deselected
• full SQLite matrix: 1,418 passed, 12 skipped, 1 baseline-known test deselected
• KDF suite: 27 passed
• contract generation/drift clean
• independent Python and DigitalBazaar Node verifiers accepted valid credentials and rejected tampering

The excluded canary test fails unchanged on the pristine production base in this local dependency environment; it is not introduced by this branch.

AI disclosure: implemented with significant Codex assistance and independently exercised across both storage backends, contract drift, SDK parity, and offline verifier paths.

[AgentTanuki]

Superseded by the exact same certified head on ship/counterparty-wallet-decision. Ship run #57 now owns CI, merge, deployment gating, and automatic recovery; closing this staging PR avoids duplicate active review surfaces.