fix(funding): recover receipts safely on a patched Console build

[halfaipg]

What / why

• Preserve in-memory receipts and continue credit recovery if browser storage fails after broadcast. Handle read/cleanup errors without crashing or misreporting a successful claim.
• Require writable receipt storage before payment-wallet operations, and recheck for an existing pending receipt.
• Add required production-build Playwright tests covering Google/wallet fixture sessions, desktop/mobile reload, 425 then 503 claim failure, already-credited retries, malformed storage, cleanup failure, storage denial, and an otherwise payable wallet blocked before any new wallet call.
• Patch release-gating dependencies: Next.js 16.3.3, Sharp 0.35.4, js-yaml 4.3.2, browser-mapping and provider-utils. Require production dependency auditing in CI. Upstream image advisory: GHSA-2xp9-vwfh-vxw4

Verification

Node 22.23.2 production build, strict lint, formatting, generated CSS, auth, key-management, OAuth, validator evidence/consent/pairing suites, and funding browser smoke pass locally. Production audit: no known vulnerabilities. Full reachable-history Gitleaks passed with existing reviewed fingerprints. Desktop/mobile screenshots inspected.

Risk / boundaries

No account, billing, wallet-linking or Core policy changes. Tests use loopback services and synthetic encrypted sessions, not real OAuth, wallets or chain transfers. The new browser test reproduced the storage-denial failure before the runtime fix. A fixture timing issue was corrected by waiting for wallet selection to finish before entering an amount. No production deployment yet; global billing activation remains separately gated.