Take viem 2.56.8 to match the coupled set

[vvillait88]

Summary

Part of the 2026-09-21 dependency sweep. viem moves from 2.56.7 to 2.56.8 in the dev dependency and the override, keeping node-commerce on the same exact pin as pay and the storefronts. viem is not a runtime dependency or peer of the published package, so nothing that ships changes and there is no release. Scoping: 2.56.8's runtime files differ from 2.56.7 only in the version string and one comment. The rest is type declarations.

Merged on main earlier today: the dependabot minor-patch group (@a2a-js/sdk 1.2.0, @types/node, knip; the a2a SDK is dev-only and referenced from source only in comments) and dotenv 18 (dev-only, vitest setup file).

Worked with: Varun. Not done: eslint 10 and TypeScript 7 stay held per the registry. Every other exact pin (mppx, @x402/*) is already latest.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged.

Test plan

Locally: bun run lint, typecheck, knip, test (1825 passed, 4 skipped) and build all exit 0. The lock resolves a single viem@2.56.8, and OSV over bun.lock finds no issues.

Checklist

• Tests cover the new behavior, and the suite passes locally (no new behavior; the existing suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (no public surface change)
• No secrets, credentials, or personal data in the diff or the tests