feat(xona): Xona Agent x402 provider profile + discovery

[mizuki0x]

Summary

Adds Xona Agent as an x402 provider profile over the generic outbound gateway (covenant-x402), at parity with the Hyre profile, plus provider-agnostic discovery and a resale/inbound scaffold. All surfaces are opt-in and off by default.

covenant-xona crate

• Registry-driven catalog from the orbit-x402 registry (live refresh + vendored snapshot fallback), filtered to Xona's Solana-settled endpoints on the configured (network, asset) rail.
• One xona.* MCP tool per endpoint; capability-gated, budget-debited, settlement-recorded through the existing x402 accounting path (a plain ResourceKind::Tool receipt).
• Self-paid Solana 402-then-pay loop with the option's payTo pinned to the registry-advertised payee. No sponsor feePayer — the signer sidecar self-pays via SolanaSigner.
• SAP resale publishing (publish) behind the bridge + markup.

Daemon (covenantd)

• DaemonXonaExecutor binds the caller as payer; xona.* dispatch wired into call_tool.
• x402.discover: provider-agnostic orbit discovery (Request::DiscoverProviders), capability-gated by x402.discover, env-opt-in, lazily cached.
• smart_layer: default-off, fail-closed inbound resale-quality validator scaffold.

Config (opt-in)

• COVENANT_XONA_ENABLED, COVENANT_XONA_{NETWORK,ASSET,PER_CALL_CAP,ALLOW,SERVER_TITLE_PREFIX,MARKUP_BPS}
• COVENANT_X402_DISCOVERY_*
• Requires the x402 funding-key sidecar (COVENANT_X402_SIGNER_BINARY + a USDC-funded Solana keypair).

Tests

covenant-xona 24 · covenant-ipc 142 · covenantd 691 — all green. cargo fmt + clippy clean on the new code. The live_paid_call example dry-runs for free; --confirm does a real $0.03 paid call.

Docs: docs/xona-integration.md.