x402-surface-check v0.2.26

Adds attack-aware public no-payment checks inspired by the May 2026 x402 attack-control research: accept-leg resource binding, localhost/private resource URL detection, timeout/expiry metadata checks, and stronger cache severity for payment gates. Verified with npm test and npm pack dry run; published to npm via trusted GitHub Actions.