feat(agentkit): add read-only AssetFare multichain quote action provider

[odaiin]

Description

Adds a read-only AssetFare action provider to @coinbase/agentkit (TypeScript), implementing the proposal in #1500.

It exposes exactly two read-only actions over AssetFare's public REST/OpenAPI v2 quote service across Solana, Base, Arbitrum, and Robinhood Chain:

• assetfare_get_capabilities — reads the current public route scope and verifies the non-custodial safety boundary (server signing/submission disabled).
• assetfare_quote_route — requests one fresh, fee-inclusive quote for a supported $1–$1,000 route and returns it with explicit comparison guidance.

Non-custodial / read-only by construction: the provider has no wallet, private key, authentication, session, prepare, sign, submit, fund, swap, or bridge path. Every response carries guidance that AssetFare must be treated as one comparison candidate, requoted before selection, and never auto-selected. supportsNetwork is true because each quote request carries its own chain fields.

Closes #1500

Tests

All tests are mock-based (no live network, no wallet, no quote execution) and run in the standard AgentKit suite:

Package: typescript/agentkit
pnpm run check   # tsc --noEmit → pass
pnpm run lint    # eslint → pass
pnpm run format:check  # prettier → all files formatted
jest src/action-providers/assetfare  → 4/4 passed

Jest cases:

• validates capped non-identity quote inputs (chains/tokens/$1–$1,000, identity rejected)
• reads capabilities only when the public non-custodial boundary is active
• posts only the five public quote fields and creates no execution state
• fails closed when the quote safety boundary changes (e.g. server submission enabled)

Note: this contribution is read-only and deliberately performs no live quote POST, wallet action, or transaction. Behavior is validated with injected fetch mocks; maintainers can exercise a live $1 quote against https://api.assetfare.dev/v2/quote if desired.

Checklist

• Added documentation to all relevant README.md files (provider README + agentkit README provider table)
• Added a changelog entry (.changeset/smart-geckos-quote.md, @coinbase/agentkit patch)

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[cb-heimdall]

Review Error for MVPuknowme @ 2026-09-17 07:47:10 UTC
User failed mfa authentication, either user does not exist or public email is not set on your github profile. \ see go/mfa-help

[odaiin]

The implementation and public checks are unchanged and green. Heimdall did not count the recent approval because it came from a non-Coinbase account without the required MFA/public-email profile. @0xRAG, when convenient, could you provide the one qualified CODEOWNER review required by the gate? No urgency; I will avoid further review pings.

[odaiin]

Superseded by #1513, which reflects the current six-chain/76-route, no-business-maximum public contract and updated fail-closed cost/availability checks. Closing this older capped-scope proposal to avoid duplicate review.