docs: design transparent MPP egress

[decofe]

Summary

• Design transparent MPP payment and replay at Centaur’s existing per-sandbox iron-proxy boundary.
• Specify the bounded upstream replay hook required because iron-proxy response transforms cannot perform a second round trip.
• Define host-side wallet authorization, budgets, audit durability, failure semantics, and staged delivery.

Validation

• git diff --check
• Reviewed against iron-proxy v0.49.0 request/response pipeline and nanocodex PR [codex] add Slack chrome to landing demo #70.

Prompted by: @gakonst

[brendanjryan]

Implementation is now in #1234. The final v1 design uses the existing global MPP_PRIVATE_KEY, supports Tempo charge intents only, replaces the market-specific tool with registry-backed discovery/request commands, and deploys one shared signer with execution leases, optional atomic budgets, durable audit state, bounded metrics, and last-known-good registry caching. Per-user wallet onboarding is deferred.

The matching iron-proxy retry contract is in paradigmxyz/iron-proxy#216.

[brendanjryan]

Implementation is now in #1234. It keeps the shared signer and global key, adds registry-backed discovery/execution, execution-lease authorization, optional budgets, audit/metrics/traces, and depends on the productionized retry contract in paradigmxyz/iron-proxy#216.