fix(transaction-controller): harden gas fee token preflight

[jpuri]

Explanation

Predict claim on Mobile (Polygon Safe wallets) can fail during gas-station preflight when a gas fee token (e.g. pUSD) is pre-selected but Sentinel returns an empty gasFeeTokens list and native POL is insufficient.

Two controller bugs contribute to confusing failures and bad publish fallbacks:

1. isNativeBalanceSufficientForGas treated missing maxFeePerGas/gasPrice as zero, so gas × 0 = 0 made every wallet look able to pay native gas. That could clear selectedGasFeeToken while gas estimates were still in flight (common with skipInitialGasEstimate), leading to publishes with intrinsic gas too low: gas 0.
2. checkGasFeeTokenBeforePublish set isExternalSign: true and cleared nonce before validating the selected token. When validation failed (Gas fee token not found and insufficient native balance), transaction metadata could remain in external-sign mode even though signing was never completed.

This PR hardens both paths:

• balance.ts: return insufficient when gas or fee fields are unset, so pre-selected gas fee tokens are not cleared prematurely.
• gas-fee-tokens.ts: only enable external sign after the selected token is confirmed in freshly fetched gasFeeTokens; on failure, persist refreshed tokens but reset isExternalSign to false before throwing.

No breaking API changes. Scope is limited to @metamask/transaction-controller publish-time gas-fee-token gating.

References

https://consensyssoftware.atlassian.net/browse/CONF-1725

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Changes transaction publish gating and native-balance checks; behavior shifts from false positives (premature token clearing, stuck external sign) to stricter failures when fees or tokens are unavailable.

Overview
Hardens publish-time gas fee token checks so pending or missing gas estimates no longer look like zero-cost native gas, and failed preflight no longer leaves transactions stuck in external-sign mode.

isNativeBalanceSufficientForGas now returns insufficient when gas or fee fields (maxFeePerGas / gasPrice) are unset, instead of multiplying by zero and incorrectly clearing a pre-selected gas fee token while estimates are still loading.

checkGasFeeTokenBeforePublish now confirms the selected token exists in freshly fetched gasFeeTokens before setting isExternalSign and clearing nonce. On validation failure it persists the refreshed token list, resets isExternalSign to false, then throws—rather than leaving external-sign metadata after an error.

^{Reviewed by Cursor Bugbot for commit 447935c. Bugbot is set up for automated code reviews on this repo. Configure here.}