Probe sample envelope always carries resource; thread extensions

[vvillait88]

Summary

Python twin of agentscore/node-commerce PR 109 (2.9.0). x402 v2 envelope validators (mppx, and the shared discovery engine behind x402scan and MPPScan) refuse a PAYMENT-REQUIRED header without a resource block, so a discovery-probe sample that omitted it read as "no valid x402 response"; the same engines read the Bazaar extension's example input to build valid bodies for their follow-up probes, so a probe without extensions got re-probed with junk bodies and the merchant's validation answers were reported as paywall failures.

• build_discovery_probe_response: the sample envelope now always carries a v2 resource (explicit resource, the resource_url shorthand, or synthesized from the realm with an http-prefix guard) and threads optional extensions into both the header and the body mirror.
• Checkout: an x402_sample on discovery_probe inherits resource (the checkout's own url + resource_info) and enriched Bazaar extensions from discovery_extensions; explicit values still win.
• Version bumped to 2.7.0. Worked with Varun (fix-all ruling on the scanner-sweep findings).

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

X402SampleProbe gains optional resource and extensions fields. No caller migration needed: existing configs keep working, and their emitted probes gain the resource (and, under Checkout, the inherited extensions) that validators require. The real 402 path is untouched.

Test plan

New tests: probe always carries resource (synthesized and explicit) and mirrors extensions in header and body; Checkout inheritance test (resource from url + resource_info, extensions from discovery_extensions). uv run pytest (1863 passed, coverage 95.37% over the 95% gate), uv run ruff check/format --check, uv run ty check all green locally. Deployed-path smoke with mppx validate and the @agentcash/discovery engine follows the core-store dep bump, this session.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests