Move the coupled settle set: viem 2.55.19, mppx 0.8.18, cut 0.4.14

[vvillait88]

Summary

Moves viem 2.55.13 to 2.55.19 and mppx 0.8.17 to 0.8.18. Both are exact-pinned members of the coupled settle set, so they move together.

viem is new chains plus fixes. The one release flagged Breaking is viem/tempo renaming a Tempo Earn recovery parameter, and nothing in these repos imports viem/tempo: the only entrypoints used anywhere are viem, viem/accounts and viem/chains.

mppx 0.8.18 is a much larger patch than the number suggests, and the parts that reach the settle path are exactly why the registry makes this set owe a live all-rails settle rather than a reading:

• Tempo transactions normalized before broadcast so accepted recovery-ID encodings match the node's canonical transaction hash
• Stripe PaymentIntent idempotency keys move to an SDK-independent mpp_ prefix
• stripe.create(): defaultMethods() now returns sync SPT-only when no depositAddresses is provided
• challenge parsing fixed for mixed-case auth-param names and for extension params named after Object.prototype properties

Worked with

Varun, who asked for the coupled set after the bun work.

Out of scope / what I did not do

• incur is deliberately not here. It is a separate hold (the patched-dependency rule, not this set). 0.5.1 still ships the indirect importModule = (specifier) => import(specifier) pattern our patch exists for, so a bump means re-cutting the patch, and a 0.x minor on pay's CLI framework wants its own pass with the compiled-binary MCP handshake.
• Nothing here changes our own code; it is a dependency move.

Verification

Gates with real exit codes across every repo in the set: lint 0, typecheck 0, test 0 (and build 0 where there is one).

The live all-rails settle the registry requires is run after this lands and deploys, since it can only be exercised against a deployed storefront. The harness is proven: earlier today the same smoke settled real payments on all three rails plus a gated endpoint against the live store.

Type of change

• Docs, tests, or internal maintenance only

Public API

None. No exported surface changes; the dependency versions move.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests