CI: a weekly canary that installs the newest in-range dependencies and runs the SDK tests #227

Dependabot ignores the majors we cannot take yet (#188), and an earlier mppx bump already broke MPP without anyone noticing. A weekly job should catch that before a user does: install the newest versions that packages/sdk/package.json allows (@x402/*, @stellar/mpp, mppx, @stellar/stellar-sdk 16.x), run the SDK tests, and open an issue when they fail.

Done when:

• A scheduled workflow does the install without the lockfile and runs the SDK test suite.
• A deliberately broken range on a test branch shows it failing and opening the issue (link the run).
• It never changes package.json or the lockfile on main.

Out of scope: moving to @stellar/stellar-sdk 17. @x402/stellar 2.29.0 still asks for 16.4.1 or newer in the 16 series.

Owner: @fernando-mendoza

Drafted with Claude (Sonnet 5.5) and reviewed by @Eras256.