Clarify Link fill-only checkout guidance

[hiroTamada]

Summary

• Document Link browser checkout as fill-only, with no aliases or egress substitution; retain OAuth, approval, and single-use card issuance guidance.
• Qualify checkout aliases and hold/approval/replay as AgentCard-only, retaining required vault attachment and no-retry/no-fallback warnings.
• Clarify that fill writes real browser-readable values, may partially fill or return unknown outcomes, and does not establish payment success.
• Move alias-preservation output tests to AgentCard, cover requested/ready Link responses without aliases, and add provider-boundary help regressions.

The existing formatter and fill request plumbing already support these response and operation contracts. No SDK, dependency, or generated-file changes.

Validation

All commands below passed with GOCACHE=/tmp/cli-go-build (the default cache directory was not writable):

• go test ./cmd -run 'Test(Vault|Credential)' -count=1
• make test (go vet ./... and go test ./...)
• go test ./... -count=1 -json: 1,533 passing test/subtest results, no skipped tests; four packages have no test files.
• make build
• Inspected built kernel vaults items invoke --help output.
• Reviewed git diff main...HEAD; git diff --check main...HEAD passed.

No live checkout or production mutation tests were run.

---

Note

Low Risk
Documentation, CLI help, and test-only changes with no SDK or payment execution logic modified in the diff.

Overview
Updates README and kernel vaults / items get / items invoke help so payment checkout guidance matches provider boundaries: Link browser checkout is fill only (vault must be attached), with no state.aliases or egress substitution; AgentCard-only aliases remain the separate hold/approval/replay integration and are not a fallback after failed fill.

Documentation also spells out fill semantics more explicitly—real values land in the browser (CDP-readable), forms are not explicitly submitted, partial/unknown outcomes stay non-retry, and completed ≠ paid.

Tests split alias output coverage into AgentCard vs Link fixtures, add TestVaultOutputLinkHasNoAliases, and lock help text with TestVaultPaymentHelpProviderBoundaries so old “aliases as alternative” wording cannot regress.

^{Reviewed by Cursor Bugbot for commit 2f989e4. Bugbot is set up for automated code reviews on this repo. Configure here.}