Harden Fund Wallet and 402 Pay package profiles

[ty-everett]

Closes part of #324.

Summary

• converts @bsv/fund-wallet into a tested CLI-only ESM package with strict input validation, zero-warning lint, coverage, and an installed-bin tarball check
• converts @bsv/402-pay to matched ESM/CommonJS root, server, and client entry points with strict declarations and clean-consumer artifact checks
• hardens BRC-121 parsing, public-key/nonce validation, payment error semantics, header preservation, and non-GET cache behavior
• documents configurable browser CORS behavior without imposing an origin allowlist
• replaces the Paymail example's permanently failing placeholder test with real TypeScript validation
• fixes a Wallet Toolbox IndexedDB test flake caused by millisecond-based duplicate unique txids
• ratchets repository health from 119 to 108 findings with zero control errors

Local evidence

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm build
• pnpm test (all 36 non-root projects passed)
• pnpm lint
• pnpm docs:build (95 routes, 100 HTML files/link checked)
• pnpm audit:security (no known vulnerabilities)
• pnpm check-versions
• pnpm health:check (108 findings, 0 control errors)
• pnpm license:pack-check (30/30 public tarballs)
• @bsv/402-pay: 105 tests, 100% statements/branches/functions/lines; strict ESM/CJS tarball consumers pass
• @bsv/fund-wallet: 12 tests, 92.23% lines and 93.15% branches; installed fund-metanet --help tarball consumer passes
• IndexedDB uniqueness regression: 10/10 repeated targeted runs passed

pnpm codegen:check completed the TypeScript generator but the local Python leg could not start because uv is not installed on this Mac; hosted CI is authoritative for that check.

No package versions, npm tags, or releases are changed by this PR.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​vitest/​coverage-v8@​4.1.10

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 95.00000% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/helpers/fund-wallet/src/cli.ts	93.39%	6 Missing and 1 partial ⚠️
packages/helpers/fund-wallet/src/index.ts	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[ty-everett]

Maintainer approval-in-substance by ty-everett for exact head 4161470a390d307235c4d5afe591b0864607a14a.

I reviewed the implementation and verification evidence and approve this change for admin merge. GitHub does not permit a pull request author to submit a formal APPROVE review on their own PR, so this comment records the requested maintainer approval without waiting for another reviewer.

Verified on this exact head:

• all GitHub Actions, CodeQL, Socket, SonarCloud, conformance, artifact, test, coverage, and merge-gate checks pass;
• SonarCloud: 0 open/confirmed issues and 0 security hotspots;
• Codecov: 95.0% patch coverage; repository coverage increases from 67.91% to 68.04%;
• no unresolved review threads or requested reviewers.