chore(deps): bump @zkp2p/sdk to 0.12.2-rc.4

[0xSachinK]

Summary

• pin the published @zkp2p/sdk@0.12.2-rc.4
• consume the staging UPI catalog and current fixed merchant-policy API
• update the exact Bun lock snapshot

Validation

• bun outdated --latest reviewed
• bun run ci passed (338 tests, audit, build, packed artifact compatibility)

Deliberate holds

• unrelated patch/minor updates are outside this exact SDK adoption PR
• @types/node remains on Node 22 to match CI
• TypeScript 7 and mppx 0.9 majors remain held pending dedicated toolchain migrations

This is intentionally dependency-only; compatibility code landed separately in #67.

[0xSachinK]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T16:00:39.990155Z	8854b99	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 8854b99f0c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xSachinK]

Ship report

• Final head: 8854b99f0cf8dfe7b976cd040972203932473d0b
• Scope: dependency-only pin to published @zkp2p/sdk@0.12.2-rc.4 plus exact Bun lock update
• Local gate: bun run ci passed; 338 tests; production audit clean; packed artifact compatibility passed
• Dependency audit: bun outdated --latest reviewed with unrelated/toolchain holds documented in the PR
• GitHub CI: passed
• Codex review: no major issues on final head
• Review threads: 0 unresolved
• Rollback: revert the squash merge; no Cash package is published by this PR