feat(acp): Agentic Commerce Protocol as a master-native plugin

[pozylon]

Summary

Adds the Agentic Commerce Protocol (ACP 2026-04-17) checkout integration to master as a self-contained plugin — the checkout-session surface, product feed, .well-known discovery doc, signed outbound order webhooks, and a Stripe Shared Payment Token (SPT) delegated-charge path with agent-payment evidence capture.

The integration was originally built on v4.8.x. Because master diverged from v4.8.x back at v4.6.1 (211 commits) and re-architected the plugin system, this is a re-implementation against master's model, not a port of the old files.

Architecture (master-native)

• New packages/plugins/src/acp/ — a standalone IPlugin. Endpoints are declarative WHATWG routes (Request → Response, mounted once for both Express and Fastify via the @whatwg-node bridge); outbound order webhooks wire in onRegister.
• It registers no payment adapter — it drives services.orders.checkoutOrder({ paymentContext }) through whichever provider is configured. Nothing in the ACP layer assumes Stripe: the delegated token flows generically as paymentContext.{acpToken, acpHandlerId}, and PSP-specific handling lives in the adapter. A config-driven allowlist (ACP_PAYMENT_ADAPTER_KEYS) + handler advertisement (ACP_PAYMENT_HANDLER_*) make adding PayPal/Adyen a pure adapter add.
• Stripe adapter extended (payment/stripe/adapter.ts + stripe.ts) with the SPT charge + an evidence trail (delegated-token reference, resulting charge id, API version, timestamp) persisted on the order payment info for merchant-of-record dispute defense. SPT is pinned to Stripe 2026-04-22.preview; the base client stays on master's stable 2026-08-26.dahlia.
• Registered in presets/all.ts — self-gates via onRegister, so it stays inert until UNCHAINED_ACP_API_KEY is set.

Endpoints

POST /acp/checkout_sessions · GET|POST /acp/checkout_sessions/:id · POST /acp/checkout_sessions/:id/{complete,cancel} · GET /acp/feed.jsonl · GET /.well-known/acp.json

Every request requires Authorization: Bearer + API-Version: 2026-04-17; every POST also requires Idempotency-Key.

Validation

• tsc --build green (from a confirmed-green clean-master baseline)
• ESLint clean
• 7 ACP unit tests pass — including proofs that the payment layer is genuinely PSP-agnostic (a non-Stripe adapter/handler configured purely via env is accepted, with Stripe given no special treatment)
• Full plugins suite (115 tests) passes — the Stripe adapter change introduces no regression

Deferred (intentional)

• Durable idempotency + webhook dedupe. Both are process-local (single-instance) for now — flagged in the plugin README. A shared persistent store + durable delivery queue is tracked as a payment-system-wide follow-up, not scoped to this PR.
• DB-backed integration test. Validation here is build + unit + full-suite regression; an end-to-end ACP checkout test (guest cart → SPT charge via Stripe test-mode granted token → order) can follow.

Notes

• SPT is still Preview/Beta at Stripe (no GA as of 2026-09) — reflected in the README/config guidance.
• See packages/plugins/src/acp/README.md for the full config surface.