[codex] Fix facilitator RNG and settlement response inconsistencies

[ayushozha]

Summary

• switch Go SVM facilitator fee-payer selection from math/rand to crypto/rand and add focused coverage for managed fee-payer selection (Suggest: use crypto/rand instead of math/rand in SVM facilitator #1845)
• add a README security best-practices section that recommends counterparty risk checks before autonomous payments (Docs: recommend counterparty risk checking before x402 payments #1817)
• normalize failed settlement responses across Go, TypeScript, Python, and the shared specs so unavailable transaction and payer values are omitted instead of serialized as placeholders (Consistency issues in Settlement Response spec #574)
• add a paywall regression test that preserves query parameters in currentUrl, complementing the already-landed Express adapter fix related to query-string stripping (@x402/express Query string parameters stripped after payment #894)

Root Cause

• the Go SVM facilitator still used math/rand for fee-payer selection in financial infrastructure code
• settlement response types and examples treated missing failure data as required empty strings, which drifted across SDKs and docs
• the Express query-param bug was fixed at the adapter layer, but there was no higher-level regression coverage guarding the paywall URL flow

Impact

• Go SVM fee-payer selection now uses cryptographic randomness
• failed settlement responses no longer need empty-string transaction hashes and can omit payer information when unknown
• client, server, and spec behavior is aligned across the reference SDKs
• paywall generation keeps full resource URLs, including query strings

Validation

• go test ./mechanisms/svm/exact/facilitator ./mechanisms/svm/exact/v1/facilitator ./http
• uv run pytest tests/unit/http/test_utils.py
• pnpm --filter @x402/core exec vitest run test/unit/http/httpFacilitatorClient.test.ts test/unit/http/x402HTTPResourceService.test.ts
• pnpm --filter @x402/paywall exec vitest run src/builder.test.ts

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[vercel]

@ayushozha is attempting to deploy a commit to the Coinbase Team on Vercel.

A member of the Team first needs to authorize it.