route: report x402 payability, publish why a result ranked, and disclose where the host has an edge

[MikeyPetrillo]

Answers the two questions a seller asked in #645, and corrects an overclaim the previous PR shipped in a code comment.

1. Payable over x402, or merely findable

They flagged that two of their listed endpoints are real products but key-gated: a well-formed call returns 401 with a "get a free key" pointer, never a 402 with a challenge. An agent routing there to pay has nothing to pay against.

The obvious fix is to rank those rows down. Measured across all 65,462 rows, only 47.8% carry any payability evidence and 52.2% carry none — demoting on absence would bury half the ecosystem for absence of evidence rather than evidence of absence. So the field reports and the consumer decides:

• payable: "x402" — a price above zero, or a registry accepts entry somebody settled against
• payable: "unknown" — no evidence, which is not the same as "no"

No money was ever at risk: route-execute's external path already requires a positive quoted price and bounds spend with maxAtomic at the tier cap, so a price-less row is refused outright. The defect was routing quality on the free ranking endpoint, not settlement.

2. Why a result ranked

Every result now carries the deciding factors in the order the sort applies them: the score, where it came from (slug / name / description), health, price rank, and the tiebreak order. "Matched on description only" tells a seller to fix their slug instead of guessing.

3. The overclaim

The previous PR shipped a comment reading "no paid placement and no operator thumb". The first half is true. The second was not, written into the source of an open-source index by the people who also sell on it.

Nobody can buy rank — no paid placement, no sponsored slot, no seller-keyed term in the scoring function. But three rules favour our own catalog:

• it is exempt from the per-seller diversity cap, so it can exceed ceil(top/3) slots
• its health is asserted as 1, not measured (the crawler never probes itself), and health is the first tiebreak after score
• the listing-injection filter applies to external rows only

All three are deliberate and defensible; none was discoverable without reading the source. They now ride on every /api/route response in a neutrality block, with include=external named as the switch that removes us, and each result states whether its health was measured or asserted.

Verification

• 21 assertions added, 79 total in scripts/test-discovery-note.js, in CI
• The disclosure guards drift in both directions: the tests read the scoring function and fail if any seller-keyed term appears, and read the source for each advertised advantage and fail if one is removed without updating the disclosure
• Six mutations, all killed: local-seller score bonus, silently removing the cap exemption, dropping a disclosed advantage, labelling asserted health as measured, reporting unknown payability as "none", and counting an explicit $0 as payable
• Sweeps clean: 210 strict / 296 lenient tools, 526/526 through MCP