phase 7 production

[y-klochikhin]

No description provided.

[JavadManashti]

Approving — content is solid and I verified the mechanical concerns rather than just flagging them.

Verified clean:

• .cursor/skills/ and skills/ trees are byte-identical (only skills/README.md differs, correctly) — and the Sync provider files workflow passed, so the duplication is automated, not manual drift.
• All three webhook fixtures: .raw.txt parses to exactly the same JSON as the pretty .json. The documented shasum -a 1 signature example will work against the raw bytes as written.
• No broken relative markdown links repo-wide; no dangling refs to the removed ## Country Handling section in payment-methods-list.md.

Non-blocking nits for a follow-up:

1. "Phase 7" now means two different things. headless-checkout-integration gains Phase 7 — Payment country, while shop-setup gains Phase 7 — Production / go-live — and headless's own line 111 says "Production / go-live is Phase 7 of shop-setup" immediately after declaring its own Phase 7. Each skill has its own sequence so it's defensible, but an agent reading both in one context could conflate them. Consider naming headless's as Phase 7 (checkout) — Payment country or renumbering.

2. status: draft vs README "Done". production/SKILL.md frontmatter says status: draft, but README.md and skills/README.md list it (plus headless-checkout-integration and webhooks-impl) as Done. Every skill in the repo is still draft in frontmatter, so this is a pre-existing convention gap this PR widens — worth reconciling in one pass so the frontmatter is the single source of truth.

3. Fixture data. 8.29.109.241 in payment.json / user_validation.json is a real routable address and reads like a capture of someone's actual IP. dry_run: 1 / mode: "sandbox" confirm these are sandbox captures, so no live-money exposure, but since these ship as public example content I'd swap the IP for a documentation-range one (203.0.113.x, RFC 5737) and double-check project_id: 308077 / merchant_id: 887981 are throwaway sandbox IDs you're happy to publish.

Nothing above blocks the merge — the guidance itself is the strongest part of this PR. The payment-country.md IP-resolution table (especially the Fastly/Cloud Run egress-IP warning) and the "ask the developer how goods are granted rather than inventing an inventory" instruction in handler-and-reliability.md both target real failure modes agents hit today.