[SergeevDmitry]

What changed

• plugins/agent-commerce-gateway/.claude-plugin/icon.png: a 1024 x 1024 PNG (37 KB) of the logo from acg.devlab.group (favicon.svg).
• plugins/agent-commerce-gateway/README.md: a "Credentials the gateway uses" table, and a note that the default facilitator needs no credentials.
• tests/unit/cli/skill.test.ts: checks that the icon exists.

Why

The developer portal's Validate step on plugins/agent-commerce-gateway (master @ 3d016ba) reported:

• No icon. The directory takes the listing icon from .claude-plugin/icon.png only the first time a plugin is saved or submitted, and adding it later does not change the listing. It has to be in the repository before the submission.
• Uses a credential from the user's machine (policy hold, 5 findings). The check flags a credential-named ${VAR} in the same file as a remote URL: GATEWAY_SHARED_SECRET beside x402.org, ADMIN_TOKEN beside the Base Sepolia RPC URL, BACKEND_TOKEN beside github.com links. None of these values goes to those hosts. The portal's options are a ${user_config.KEY} value, which applies to MCP servers and hooks rather than a config the skill writes, or leaving it for a reviewer to confirm. This PR keeps the skill as it is and gives the reviewer the table in the README: each variable and the only party it is sent to.
• Unrecognized field documentationUrl and supportUrl: the portal says "No action needed", since the directory reads them for the listing.

How it was tested

• npx vitest run tests/unit/cli/skill.test.ts: 10 passed.
• npx biome check .: clean. node scripts/check-package-metadata.mjs: OK.
• claude plugin validate ./plugins/agent-commerce-gateway: passes; the only warnings are documentationUrl and supportUrl, as before.
• npx vitest run: 3504 passed, 3 failed, 6 skipped. The 3 failures are the same macOS-only ones as on master (bash 3.2 without mapfile in the two gateway-entrypoint tests, and the adapters 413 test).

Not covered

• No change to the skill's files, so the policy hold stays until a reviewer confirms it.
• The portal's Validate has to be run again on the new commit after the merge.