hunch: tag the project (@playhunchxyz + token) on every reply + sync partner-API upgrades

[rajkaria]

Updates the hunch skill to match the live PlayHunch partner API. Additive, and the existing x402 security hardening is fully preserved — the Security invariants section, signingPolicy pin-check, and untrusted-input handling are all kept, and x402-registry.json is unchanged.

Headline change — every reply now credits the project

Today a Hunch market reply tags no one. This adds server-built attribution to every reply:

• @playhunchxyz (Hunch) is always tagged, plus the market's token project when there's a verified handle — e.g. a $LFI market tags @playhunchxyz @lienfiapp, a $VVV market tags @playhunchxyz @AskVenice.
• Handles are sourced from each token's own DexScreener listing socials (not guessed → impostor-safe); unknown tokens fail-soft to just @playhunchxyz; the replying bot's own handle (@bankrbot) is never self-tagged.
• Built server-side and baked into the verbatim copy so it renders no matter how the reply is composed: the headline (discover/trending) ends with the tags, the broadcast + digest strings include them, and the quote + positions responses gain a tags field.
• New "Project attribution" SKILL.md section + reply-shape rule (treated like the disclosure — non-negotiable).

Also syncs the rest of the partner surface this copy predated

• Screenshot-ready headline on every discover/trending match (title · odds · social proof · close · @tags).
• One-tap size chips ($1 / $5 / $10, defaultTicketUsd) — don't make the user type a number.
• Win-broadcast loop (GET /api/partner/resolved → references/resolved.md): reply in the original bet thread when a market settles, with on-chain proof + a rematch hook.
• Funding a bet on 422 insufficient_balance: lower the size, or swap a token → USDC on Base only with the user's explicit per-swap consent (never auto-swap).
• Trending headlines + digest, quote/positions tags, refreshed transcripts.

Safety

• x402-registry.json is byte-identical to the merged copy (verified) — no change to the pinned allowedOrigins / signingPolicy.
• No security content removed (verified the diff deletes no pin-check / host-pinning / untrusted-input lines).
• All money-path invariants intact: the model never picks the id or size; bets stay $1–$10; pin-check before signing; idempotent on idemKey.

The PlayHunch partner API serving these fields is already live in production.

🤖 Generated with Claude Code