Make the integration smoke probe a real 402

[vvillait88]

Summary

The weekly Integration workflow's "Probe an x402-gated testnet endpoint" step ran check https://example.com --json || true with continue-on-error: true. example.com never returns a 402, and both escapes swallowed any failure, so the step passed whatever check did, and every scheduled run has been green on it.

It now probes a real merchant 402 without paying: check against the fullenrich storefront's POST /company/lookup, failing unless the response is a 402 challenge (status == 402, payment_required == true) that parses into each rail pay settles on (exact/eip155:8453, tempo/charge, solana/charge). A failure prints the parsed envelope or rail list. The step is renamed to say what it does.

The check costs nothing: check reads the challenge and never signs or pays. The trade is that the smoke now depends on a live storefront, so a storefront outage reddens it, which is a real signal for a CLI whose job is paying those storefronts.

No release: only a workflow changed, and nothing in the published package or binaries differs from 0.5.6.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

• The step's script, run locally against fullenrich: exit 0, all rails parsed. Against https://example.com: exit 1 on the 402 assertion. So it passes on a real challenge and fails on a page that is not one.
• Integration workflow dispatched on this branch (run 34874790234): all three matrix jobs succeeded, the base job's new step succeeded and logged the parsed rails.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

Worked with Varun.