fix: verify charge hashes by credential source

[brendanjryan]

Summary

Charge-only fix for smart-account push payments (for example, Crossmint/ERC-4337):

• uses Credential.source as the expected Transfer sender for Tempo charge hash credentials
• keeps the existing receipt.from fallback for clients that do not send source
• rejects malformed or wrong-chain hash credential sources instead of silently falling back
• preserves existing challenge-bound MPP attribution memo verification for push hashes

This lets a smart wallet broadcast a transferWithMemo itself and submit a hash credential whose source is the smart wallet DID, even when the transaction's top-level sender is a bundler or EntryPoint path rather than the smart wallet.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/mppx@414

commit: 21706e3