Probe sample envelope always carries resource; thread extensions

[vvillait88]

Summary

x402 v2 envelope validators (mppx, and the shared discovery engine behind x402scan and MPPScan) refuse a PAYMENT-REQUIRED header without a resource block, so a discovery-probe sample that omitted it read as "no valid x402 response" on every probe-configured merchant, however correct its accepts were. The same engines read the Bazaar extension's example input to build valid bodies for their follow-up probes, so a probe without extensions got re-probed with junk bodies and the merchant's own validation answers (400/404) were reported as paywall failures.

• buildDiscoveryProbeResponse: the sample envelope now always carries a v2 resource (explicit resource, the resourceUrl shorthand, or synthesized from the realm, with an http-prefix guard) and threads optional extensions into both the header and the body mirror.
• Checkout: when discoveryProbe is configured with an x402Sample, the sample inherits resource (the checkout's own url + resourceInfo) and enriched Bazaar extensions from discoveryExtensions; explicit values still win.
• Version bumped to 2.9.0. Python twin lands in agentscore/python-commerce as 2.7.0. Worked with Varun (fix-all ruling on the scanner-sweep findings).

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

DiscoveryProbeConfig.x402Sample and buildDiscoveryProbeResponse's x402Sample gain optional resource and extensions fields. No caller migration needed: existing configs keep working, and their emitted probes gain the resource (and, under Checkout, the inherited extensions) that validators require. The real 402 path is untouched.

Test plan

New tests: probe emits resource from all three sources (explicit, resourceUrl, synthesized) and mirrors it in the body; extensions thread into header and body; Checkout inheritance test (resource from url+resourceInfo, extensions from discoveryExtensions). bun run test (1817 passed), bun run typecheck, bun run lint all green locally. Deployed-path smoke with mppx validate and the @agentcash/discovery engine follows the consumer bumps in each store repo, this session.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests