Build a spending mandate for the PRINCIPAL to sign

Handing money to an autonomous agent is all-or-nothing today, and every existing control sits on the WRONG side of the trust boundary: a limit the agent enforces on itself is a limit it can drop, and a limit in its prompt is a suggestion. This builds a budget the PRINCIPAL signs with their own wallet. Robyn never signs mandates and holds no principal keys — a budget signed by Robyn would be a budget Robyn granted itself. SCOPE: covers spending THROUGH ROBYN only. It is not custody and cannot stop the agent spending elsewhere with the same key; the payload says so. Treat it as an auditable budget, not a hard cap. Optional cosignAbove (base units) adds a PER-SPEND approval threshold: spends above it require the principal to countersign that specific payment. Omit it, or pass 0, for no threshold — mandates granted before this existed behave exactly as before. Pass sandbox: true (and on register) to create a throwaway mandate in a separate store — used by our own tests so test grants never appear in an owner's exposure figures.