build(deps): re-pin cloud-commitments-go past #151 and migrate PurchaseResult.Cost (*float64)

[cristim]

cloud-commitments-go#151 changed PurchaseResult.Cost from float64 to *float64 (nil = unknown upfront cost), so re-pinning past it is a compile break here. Migration per the #151 review: tools/purchase.go ~673 nonZeroCostPtr(result.Cost) becomes Cost: result.Cost; purchase_test.go ~432 Cost: 600 becomes ptr(600.0). Do the re-pin and the migration in one PR.

[cristim]

Merged via #34 as 49c5d20 after independent GPT-6 Astra final-HEAD adversarial review and all required CI checks passed. Local independent review replaces CodeRabbit per the owner's instruction.

Fresh post-merge verification on fetched main passed with Go 1.26.6 and GOWORK=off: the race-enabled registered MCP purchase protocol test preserves omitted/zero/positive cost; TestEndToEndSearchThenDryRunPurchase exercises the real server protocol; go build ./... passes. The five changed files match the reviewed commit, and the checkout is clean. Cloud boundaries are mocked; no live purchase or deployment is claimed.

Pre-fix proof separately demonstrated the old scalar assignment's compile failure and the old zero-omitting conversion failing the known-zero protocol assertion. Full race tests, vet, pinned golangci-lint 2.10.1, module verification, tidy and pre-commit checks passed before publication.

Provider standalone dependency mismatch discovered during parallel work is tracked in cloud-commitments-go#154; this consumer pins all four modules together and passes its own build.