feat(cli): refresh agent integrations and staging UPI support

[ADWilkinson]

Peer CLI rejected UPI before reaching the staging Curator even though the SDK and staging contracts support it. Refresh the shared CLI/MCP runtime and prepare release 0.4.0.

• Add staging-only UPI discovery, quotes, Curator comparison, payee registration and deposit/intent previews; keep production/preproduction rejection and leave Peerlytics/Cash platform support unchanged.
• Adopt published @zkp2p/cash 0.5.3 and @zkp2p/sdk 0.14.1, sharing stable contracts 0.4.1.
• Regenerate the command catalog and align release manifests/install references; pin the packaged MCP launcher to the release.

Validation: final dependency candidate 6b4d1c6 passed a fresh npm ci and full npm run check plus production audit; behavioral/E2E/live checks were performed on the unchanged command implementation at 7d4d5a9.

• npm run check passed: lint, typecheck, coverage (236 tests across 21 files), generated catalogs, CJS/declaration build.
• Focused boundary tests passed for all environments, exact UPI/INR quote arguments and unsigned deposit/intent previews.
• Actual installed SDK exposes all 94 dynamically referenced command methods, including prepareable writes.
• Packaged Peer Cash skill validator passed.
• npm audit --omit=dev passed with zero vulnerabilities after updating Hono to 4.13.7 and qs to 6.16.0 within existing ranges.
• Explicit E2E rerun passed all four cases; independent code review and final dependency-delta review found no actionable defects.
• Live built CLI returned one usable quote each from production/preproduction Wise and staging UPI. Cash App risk-window reads returned zero on production and staging. Attestation health and indexer schema introspection returned HTTP 200 on their applicable environments. Hosted MCP tools/list returned 97 read-only tools at release 0.3.1; deployment remains pending the new release.

SDK 0.14.1 and Cash 0.5.3 publications are verified against their tarballs. Final manifest/lock delta was reviewed; no runtime code changed after the independent review. After merge, publish through the native main-branch npm workflow. Hosted MCP and MCP Registry verification follow the released version. No transaction broadcasts were performed.

Release completed: npm workflow 34348650117 published 0.4.0 from merge f65ed2d. Registry latest, tarball integrity, source gitHead and dependency pins verified. Railway deployment a2b37774-41c5-40b3-9472-24435a649f62 succeeded on that commit; mcp.peer.xyz health serves 0.4.0 read-only and tools/list returns 97 tools. MCP Registry workflow 34348893797 succeeded and version 0.4.0 was read back from the registry.

[ADWilkinson]

Post-merge cascade complete for f65ed2d3e17b67f0391c8862a628fdba8c1907e7.

• GitHub confirms feat(cli): refresh agent integrations and staging UPI support #23 merged into default branch main; the live branch tip matches the event SHA.
• No mapped preprod release branch exists for peer-cli. No branch synchronization, staging/production promotion, or deployment request was performed by this cascade.
• The already-running npm publish workflow completed successfully, including npm ci and npm run check. npm serves peer-protocol-cli@0.4.0 with gitHead equal to the source SHA; downloaded tarball SHA-512 matches registry integrity.
• The existing Railway deployment independently completed: GitHub deployment 6349190846 names the exact source SHA and Peer MCP / production; its latest status is success. Read-back of https://mcp.peer.xyz/health returned HTTP 200, ok: true, version 0.4.0, profile read-only.
• Single update-channel announcement, deduplicated against recent history and verified by reading back its PR link and source-SHA marker.

No customer journey or transaction broadcast was run by this cascade. MCP Registry publication is outside this branch-sync task and is not certified by this receipt.