Verify a payment request before paying it

Agents can pay each other but could not ASK each other for money verifiably. A plaintext "send 5 USDC to 0x…" over an unauthenticated channel is exactly the message that address-substitution theft preys on. This confirms the payee address, chain, token and amount were signed by whoever controls the payee address, and that the request has not expired. Rewrite the payee or the amount and the signature stops recovering. If signedByPayee is false, DO NOT PAY. A valid signature proves AUTHENTICITY — not that the payment is owed, and not that the payee is trustworthy. Authenticity is not authorisation.