Base mainnet settlement, adversarial hardening, and v1.0.0

[SergeevDmitry]

• Base mainnet settles. Real USDC moved buyer → merchant on eip155:8453
  through a remote facilitator, verified on chain. Base Sepolia too. The gateway
  holds no key, signs nothing and pays no gas on either.
• A third facilitator auth type, cdp — a fresh JWT per request, via a
  dynamically-imported optional peer nobody else installs. none and bearer
  cover everything else and install nothing.
• allowUnauthenticatedFacilitator — a mainnet facilitator that takes no
  credential is allowed, but only by name, and doctor reports WARN for as
  long as it is.
• SSRF fixed (audit High). A {param} in the host position of
  backend.url let caller input choose which host the gateway calls; every
  path-position defence was inert there. Refused at config load.
• A facilitator failure is never the buyer's fault. The SDK throws a bare
  Error for a 401/5xx, so an outage was being recorded as a bad payment. Any
  throw now means "no verdict obtained".
• Config engine decides from the template, not the result — ${A:-${B}}
  silently corrupted adminToken; shell near-misses loaded as literal
  credentials; a resolved secret could be quoted back in an error. One rule
  closes all three.
• Closed schemas now recurse into additionalProperties — the stamper's
  third drift from the validator.
• Ledger is 0600 before SQLite opens it, mountPath validated at load,
  amount matched with !== to agree with the pinned SDK, facilitator rejection
  strings clamped before they reach a buyer or the ledger.
• New suites: test:mainnet, adversarial concurrency/restart/facilitator
  cases, CDP auth, ledger permissions. Neither public-network suite runs in CI —
  a workflow there means a funded key in repository secrets.
• v1.0.0, wire spec moved to agent-commerce/v1.0.0 while it was still
  free to move.