v2.3.2: security audit fixes

A full security audit of the payment path, the Robinhood Chain code, the catalog site and the hosted company service. Every critical and high finding is fixed, with a test that runs the attack.

Payments

• A payment can only have one encoding (low-s, canonical), so an agent cannot send a payment the chain will refuse after the call was served.
• One payment per agent nonce in flight, and a payment that does not settle withholds the response instead of giving it away.
• The client pins the tokens it pays in and their decimals, and enforces the mandate itself (expiry, realms, per-call cap, budget, the request it is paying for), so a hostile gateway cannot ask for more.
• A malformed path no longer crashes a gateway, encoded slashes cannot walk to unpriced upstream paths, realm globs are linear, and an upstream cannot replace the signed receipt.

Hosted companies

• Agents, gateways and every URL a run fetches reach only public addresses (checked at connect time, no redirects).
• Concurrent runs reserve budget, a run's mandate expires with it and late spend is booked, model cost stops at the budget, and runaway ticket loops are blocked.

Catalog site

• Receipts relayed from gateways are shape-checked and escaped, routes stay on their gateway's origin, the same egress guard covers every fetch, and responses carry security headers.

269 automated checks (e2e 81, adversarial 48, evm 46, company 94) plus 21 browser checks.