feat(agent): answer USDT0 questions with the verified issuer

[royalTreasure]

closes #795

Summary

The agent now resolves USDT0 (and USDC) by issuer, names the issuer when it answers, and reports a same-code asset from a different issuer as unverified. A code match alone never verifies anything.

Changes (packages/agent)

• New src/assets.ts: a small registry pinned by issuer per network (mainnet USDT0 GATISXX6…HN6Q with its SAC and issuer-controls; USDC per network), classifyHolding / classifyBalances (verified = code and issuer match, unverified = registered code but a different issuer, unlisted = code not in the registry, nothing claimed), and describeAsset.
• get_wallet_balance keeps its flat balances and adds holdings: each issued asset with its issuer, status and a plain-language message. A fake USDT0 is reported as UNVERIFIED with its issuer and the registered issuer; a real one is reported with its issuer.
• New get_asset_info tool answers "what is USDT0": verified issuer, SAC, and that the issuer can freeze a trustline and claw back a balance; given CODE:ISSUER it says whether that issuer is the registered one.
• System prompt rule 8: name the issuer, relay "unverified", never call an impostor the real asset.
• README and frontend/docs/pages/agent-integration.mdx tool tables updated.

Verification

In packages/agent (plain npm install):

• npm test -> Test Suites: 8 passed; Tests: 71 passed (12 new across assets.test.ts and agentAssets.test.ts, 59 existing). The "import after the Jest environment has been torn down" noise comes from server.test.ts and appears with or without this change.
• npx tsc --noEmit -> clean.
• Fail-before: agentAssets.test.ts run against the original agent.ts -> 6 failed, 6 total.
• The tests assert the tool result the model receives (runAgent with a scripted provider and a mocked getBalances), not the model's closing text. The pinned SAC is derived from the issuer (Asset.contractId(Networks.PUBLIC)) and compared, and every hard-coded G/C address is checked with StrKey.isValidEd25519PublicKey / isValidContract.

Caveats

• The registry is deliberately tiny (USDT0, USDC). Other codes come back unlisted, never "verified". Adding an asset means adding its issuer, not its code.
• On testnet there is no verified USDT0, so any USDT0 holding there is not reported as verified.
• The agent's get_price / build_payment inputs are unchanged (they already take CODE:ISSUER).
• Not run: a live model or a real Horizon account; getBalances is mocked in the new tests.
• The issue's "Part 2 — three gaps in the privacy batch" section lists no concrete items, so nothing was done for it.

[drips-wave]

@royalTreasure Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@royalTreasure is attempting to deploy a commit to the miracle656's projects Team on Vercel.

A member of the Team first needs to authorize it.