feat(consult): add authorization-window-within-ceiling pay Condition

[gabchess]

Summary

• Adds authorization-window-within-ceiling, a pay Floor Condition comparing an EIP-3009 authorization's validBefore against the owner's authorizationWindow policy. The policy field mirrors role's shape: { mode: "not-required" } or { mode: "required", maxSeconds }, an integer from 1 to 86400.
• Every existing pay fixture now states authorizationWindow: { mode: "not-required" } explicitly, so no prior allow changes. A policy that omits the field, or sets mode: "required" with a malformed maxSeconds, answers UNVERIFIED rather than guessing a default.
• Adds policyFields to every catalog Condition: the list of Policy fields its checker reads (empty for a Condition that decides from the request or a static registry alone). validateCatalog now rejects a policy-reading Condition that declares none, and the value is exposed through describeCatalog().
• Regenerates augment/data/*.json from the built catalog, adds one new offline eval (pay-authorization-window-past-deny), and documents the new Condition in consult/references/pay/ and the agent skill's conditions.md.

Public repository check

• Every name, link, and process reference makes sense to an external reader.
• Internal-only instructions, planning records, approval records, and private outreach work are absent.
• Product, grant, adoption, deployment, and security claims cite public evidence.
• npm run public:check passes.

Test plan

• yarn consult:typecheck, yarn consult:build, yarn consult:test (500 passing)
• yarn mcp:typecheck, yarn mcp:build, yarn mcp:test (165 passing, 3 pending, unchanged)
• yarn sdk:typecheck, yarn sdk:test (27 passing, unchanged)
• npm --prefix app test (51 passing, unchanged)
• node scripts/verify-augment.js and node scripts/verify-augment.js --self-test
• yarn public:check, bash scripts/test-public-boundary.sh
• yarn evals:offline, yarn evals:test
• yarn lint