feat(bsv): add deferred upto payments

[linzhm]

Description

Extends the BSV mechanism from x402-foundation#2890 with the existing upto scheme semantics: authorize a maximum first, then settle one fully signed transaction at the actual amount.

• Reuses SIGHASH_SINGLE | FORKID (0x43) cap signatures while recipient control inputs sign each complete version with ALL | FORKID (0x41).
• Supports negotiated-once upto payments and cumulative stream versions through the same payload and role entrypoints; stream remains application behavior, not a new protocol object.
• Verifies amounts by owner net input/output delta, including multi-input/output authorizations, and independently enforces recipient receipt.
• Separates validAfter, nLockTime, and deadline; requires complete BEEF plus an application-supplied PoW/SPV verifier.
• Adds one facilitator-only atomic settlement-store seam so an authorization is consumed across replicas and restarts without introducing node or transaction-family state.
• Adds the BSV profile, package exports, README guidance, tests, and changeset.

The Exact production path is unchanged. This PR targets feat/bsv-exact-scheme and depends on x402-foundation#2890.

AI disclosure: Significant implementation assistance came from OpenAI Codex. This remains a Draft pending human review; the signing and settlement paths were exercised by focused adversarial tests and independent security/API review passes.

Tests

• pnpm test from typescript: 57/57 tasks passed.
• pnpm test in @x402/bsv: 165/165 tests passed.
• pnpm lint:check in @x402/bsv.
• pnpm build in @x402/bsv (ESM, CJS, and declarations).
• Scoped Prettier check and git diff --check.

Standalone tsc --noEmit has only the three test typing errors already present on the x402-foundation#2890 base; no upto typing errors remain.

Checklist

• I have formatted and linted my code
• All new and existing tests pass
• My commits are signed (required for merge)
• I added a changelog fragment for user-facing changes

[linzhm]

Closing this draft in favor of a spec-first, reviewable PR series. No maintainer action is required here. The implementation history is preserved, and follow-up work will be separated into: (1) the BSV upto specification, (2) any independently justified behavior-preserving BSV refactor, and (3) the complete TypeScript implementation with integration coverage.