Maintenance sweep: mppx 0.13.4, Node 26 support, release 0.7.1

[vvillait88]

Summary

• Payment set: mppx 0.13.1 to 0.13.4 and viem 2.57.3 to 2.57.4, with the exact viem override moved to match. node-commerce and the storefronts move in the same pass. The client-side change that reaches pay is mppx 0.13.2's fix: a credential-bearing retry no longer follows redirects (redirect: 'manual'), so a payment credential cannot leak across origins, and a 3xx after paying reports pending instead of accepted. The zero-amount proof domain is unchanged: dist/tempo/internal/proof.js is byte-identical and still returns { name: 'MPP', version: '3' }.
• Node 26: engines.node widens to >=22 <27. A new node-compat job runs the suite on Node 22, 24 and 26, builds, and runs the built CLI under each, because before this nothing tested the declared majors.
• lefthook 2.2.1, packageManager bun 1.4.3.
• Dropped the smol-toml and source-map-js overrides: removing them against the existing lock changes nothing, and a fresh resolution keeps both at the old floors. esbuild (0.27.7 without it) and the exact viem override stay.
• Version 0.7.1.

Worked with Varun.

Not taken: eslint 10 and TypeScript 7 stay held. incur stays at 0.7.0 (still its latest), so the incur patch and the serveCli protocol are untouched. @agent-score/sdk 2.9.1 lands as a follow-up commit once it publishes.

Still owed: the coupled bump needs a live settle on Base, Tempo and Solana against a storefront once the storefronts are on the new set. It will be recorded on this PR.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

No change to commands or flags.

Test plan

Locally: lint, typecheck, knip, test with coverage (547 passed, 2 skipped), build and the darwin-arm64 binary build all exit 0, and the binary reports 0.7.1. The suite passes and node dist/index.js --version prints 0.7.1 under Node 22.23.2, 24.21.0 and 26.11.1. OSV scan clean.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (no public surface change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Live settle on the new payment set (pay 0.7.1, commerce 3.1.1, mppx 0.13.4, viem 2.57.4 on both sides), against the redeployed FullEnrich store, from the smoke wallet:

Rail	Ungated company/lookup	Gated person/enrich/work-email	Balance before	Balance after	Moved
Base	200, $0.02	200, $0.07	1.980968	1.890968	0.090000
Tempo	200, $0.02	200, $0.07	0.454762	0.364553	0.090209 (0.09 plus the network fee)
Solana	200, $0.02	200, $0.07	0.580000	0.490000	0.090000

The gated calls went through the stored Passport, which refreshed silently from its refresh credential on the first call. The lookups used our own domain and our own name.