Sync latest catalog-cli: checkout instruments, UCP messages, hardening - #6

Syncs the latest catalog-cli skill from local development into the repo.

Changes

complete_checkout now echoes real payment instruments

• Replaced the synthetic single-instrument / paymentToken flow with echoing back the payment.instruments returned by create_checkout.
• complete checkout now reads the create response (or a {"payment":{"instruments":[...]}} block) from stdin via --checkout-stdin, instead of --payment-token-stdin.
• selectInstrument keeps every field the merchant returned, marks it selected, and sets credential.token to the instrument's own id — the instrument id IS the checkout payment token, so re-sending the exact id is what lets the merchant match the session (mirrors the reference simulator's _select_instrument).
• Validates that instruments are present and throws a clear error otherwise.

Surface UCP checkout messages[] to the user

• New renderCheckoutMessages lifts UCP warnings/errors/disclosures (e.g. final_sale, prop65, age_restricted) out of the raw JSON into a clearly-labeled block, since the protocol requires warning/disclosure content be shown to the user.
• checkout create/update now run through runCheckoutAction, which prints the messages block above the full JSON.

Docs

• Updated SKILL.md and references/direct-api.md to match the new checkout completion flow.

Verification

• pnpm typecheck — passes
• pnpm test — 59/59 passing