feat(acp): add experimental ACP checkout adapter

[Revinand]

Summary

Add experimental, opt-in support for the Agentic Commerce Protocol checkout service, pinned to the stable 2026-04-17 snapshot.

The adapter maps checkout creation, retrieval, updates, completion, and cancellation onto the existing canonical execution pipeline. Merchants keep their checkout and payment logic; the gateway handles protocol validation, authentication, and durable request idempotency.

What changed

• Add ACP configuration, disabled by default, with /acp as the default mount path. All five checkout operations require explicit mappings to resources with expose: [acp].
• Vendor the stable ACP schema and official examples. Validate discovery documents, incoming requests, and merchant responses against the pinned contract.
• Publish public seller discovery at /.well-known/acp.json, advertising the checkout service and REST transport.
• Require bearer authentication and API-Version: 2026-04-17 on checkout routes, plus Idempotency-Key on every POST.
• Add a separate SQLite idempotency store with at least 24 hours of retention. Completed retries replay the stored response without another execution; concurrent requests return 409, and conflicting bodies return 422. Responses with 5xx status are not cached.
• Route all checkout operations through the shared execution pipeline and map outcomes to ACP session responses and safe protocol errors.
• Forward checkout payment_data unchanged to the merchant. Reject mappings to resources that charge for invocation or configure Agent Commerce payments.
• Wire ACP into gateway startup, discovery, readiness, and agent-commerce doctor, including supported capabilities and unsupported operations.
• Share SQLite initialization and file-permission handling between receipt and idempotency storage.
• Add unit, gateway integration, and conformance coverage for checkout operations, request guards, response validation, retries, errors, and adapter isolation.
• Document configuration, security, protocol limits, and an example integration with a merchant checkout API.

Supported scope

This initial implementation supports:

• ACP stable snapshot 2026-04-17
• REST transport and seller discovery
• Create, get, update, complete, and cancel checkout sessions
• Bearer authentication
• Durable idempotency for checkout POST requests
• Merchant payment data forwarding through the canonical pipeline

Checkout state, expiry, and state transitions remain the merchant backend's responsibility. The gateway persists idempotency records rather than the ACP-owned checkout state.

Idempotency protects ordinary retries and concurrent requests. It does not guarantee exactly-once execution across a merchant HTTP call and a local database commit. If the process crashes after the merchant acts but before the response is stored, the key remains in flight until it expires.

Carts, feeds, standalone orders, delegated payment and authentication services, webhooks, ACP's MCP binding, signature and timestamp verification, extensions, and other API versions are not implemented.

Compatibility

ACP remains disabled unless explicitly enabled. Existing HTTP, MCP, and A2A configurations continue to work, and an ACP startup failure remains isolated from other adapters.

Checkout resources must be free at the Agent Commerce invocation layer. Merchant purchase payments remain separate from x402 payments.

The adapter uses vendored schemas and examples; it does not fetch specifications at runtime or require an ACP SDK.