feat: share runtime with async HTTP payments

[parvahuja]

Stack 4 of 8 · depends on #184 · next: #190

Summary

• let asynchronous HTTP payments use a shared PaymentRuntime
• add explicit origin policy and correctly scoped challenge cookies
• protect against repeated challenges, concurrent duplicate sends, and uncertain payment outcomes
• preserve streaming and event behavior while delaying close through a committed paid retry
• keep the owned AnyIO loop reusable when a callback raises a non-Exception base exception

Safety boundary

A paid request is retried only when its challenge and outcome are safe to reuse. Ambiguous post-payment failures fail closed instead of risking a second payment.

Scope

Async HTTP only. This PR does not add sync HTTP, HTTPX adapters, global instrumentation, or MCP integration.

Validation

• 861 passed, 41 skipped
• adversarial coverage for origin matching, cookies, duplicate sends, close races, replay protection, unknown outcomes, and callback aborts
• Ruff, formatting, Pyright, diff checks, and Python 3.11–3.14 CI pass

_{Managed as a stacked change with GitHub Stacks.}