Proposal: SafeRoute preflight and buffered USDC funding on Base

## Problem

AgentKit clients that pay x402 resources on Base can hold ETH/WETH but have insufficient USDC. Failing the request, adding custodial funding logic, or giving the agent broad signing authority are poor defaults. A separate preflight is also useful before an agent signs a token trade or approval.

## Proposed integration

Add an optional TypeScript action provider/example that:

1. sends the proposed Base transaction to SafeRoute Proof and verifies the signed `ALLOW | BLOCK | REVIEW` receipt;
2. on an x402 USDC shortfall, requests an exact buffered AutoFund route;
3. verifies chain 8453, canonical Base USDC, payer, target balance, maximum sell, expiry, calldata, simulation result, and SafeRoute's Ed25519 receipt;
4. asks the existing AgentKit wallet provider to authorize the exact transaction locally;
5. waits for confirmation, rechecks USDC, and retries the merchant once.

SafeRoute never receives a private key or controls the wallet. The live public beta is Base-only, caps AutoFund at $10, and limits slippage to 100 bps.

Integration surfaces:
- MCP: `https://saferoute-x402-production.up.railway.app/mcp`
- OpenAPI: `https://saferoute-x402-production.up.railway.app/openapi.json`
- TypeScript wrapper source: https://github.com/crystalsignal/saferoute/tree/main/packages/x402
- Portable skill: https://github.com/crystalsignal/saferoute/tree/main/skills/saferoute-pay
- Implementation/release: https://github.com/crystalsignal/saferoute/pull/66

The smallest AgentKit-facing API could be a `safeRouteProof` action plus a fetch/payment example; no protocol or wallet-custody change is required. I can prepare a focused PR matching the repository's TypeScript action-provider patterns if maintainers agree on placement.

For embedded distribution, SafeRoute accrues 25% of successfully settled external service fees to a verified referral code; owner, QA, self-paid, failed, and duplicate jobs are excluded.