feat(types): payment-failure triage demo scenarios + scenario manifest

[dangazineu]

What

Adds the two shared DemoScenario objects for the payment-failure-triage demo to
@codespar/types/testing, plus a DEMO_SCENARIO_MANIFEST so an example that
drives these scenarios stays in sync with the published source. Bumps
@codespar/types to 0.10.12 — the version a consumer exact-pins.

This is the first of two parts: the scenarios must publish before the example can
pin them.

Scenarios

Both express one judgment at the commerce meta-tool abstraction — reading a
payment failure's category and routing the remediation (the platform owns
provider selection inside codespar_pay; the agent never picks a provider):

• CUSTOMER_DATA_REJECTION_SCENARIO — codespar_pay returns a successful
  result whose payload is a decline (category: "customer_data",
  error_code: "INVALID_CPF_CNPJ"). The agent asks the customer for a correction
  via codespar_notify, retries codespar_pay (confirmed), then issues the NF-e
  via codespar_invoice. No human escalation.
• MERCHANT_BLOCKED_SCENARIO — codespar_pay returns a decline
  (category: "non_recoverable", error_code: "MERCHANT_BLOCKED"). The agent
  notifies a human on an ops channel and stops — no retry, no invoice, no
  customer message.

A decline is a successful tool result carrying a status/category field, not
a transport error, so the meta-tool trace still reports status: "success".

Scenario manifest

DEMO_SCENARIO_MANIFEST ({ version, scenarios }) is the published contract for
these scenarios. A consumer that drives them asserts:

• completeness — the scenarios it drives equal scenarios exactly (publish a
  new scenario and forget to cover it → fail);
• version-alignment — its @codespar/types dependency is an exact pin equal
  to version (a caret/tilde or stale pin fails).

A lockstep test keeps version equal to the package version, so a publish that
forgets to bump the manifest fails CI.

Tests

npx tsc clean; npx vitest run green in packages/types (92 tests). The new
scenarios pass the existing internal-consistency checks (every fixture tool is a
meta-tool, mocked, agrees with expectMetaTools, and carries the contract's
required fields).