feat: add per-session purchase budget guard

[kickenV]

Summary

• add a canonical per-session purchase budget contract that tracks reserved, settled, refunded, reversed, released, and unresolved debits
• apply the same fail-closed checks across Bitrefill API, CLI, MCP, x402, OpenClaw, payment-link, and supported wallet routes
• make retries, concurrent purchases, refunds, multi-asset fees, aliases, and provider status transitions deterministic and idempotent
• document route-specific units, caps, approval boundaries, operational recovery, and the limits of instruction-layer enforcement

Why

Bitrefill's existing safeguards cover individual purchase decisions, but there was no shared contract for enforcing cumulative spend across an agent session. Route-specific behavior could otherwise disagree about reservations, retries, refunds, or unresolved payment outcomes.

This change builds on the existing safeguards rather than replacing them and centralizes the normative accounting rules in references/budget-guard.md.

Closes #2.

Impact

Agents can accept a user-defined session budget, reserve headroom before the first purchase-capable provider call, and refuse new spend whenever the exact remaining budget is insufficient or cannot be verified. Read-only browsing remains available, while money-moving operations fail closed until state is reconciled.

The guard is an instruction-layer safety mechanism. Provider-side and wallet-side transaction caps remain recommended as independent enforcement boundaries.

Validation

• npx -y @anthropic-ai/claude-code@latest plugin validate .
• git diff --check upstream/main
• JavaScript syntax checks for both SIWX helper scripts
• JSON manifest parsing, version alignment, and skill frontmatter validation
• local Markdown link and anchor validation across the changed documentation
• 29 deterministic accounting and concurrency scenario checks
• 48 static budget and security contract assertions