Implement SAND-WP-0006: SaaS payments, routing, and ext.saas-stub

Add credits store, metering on create/destroy, extension routing resolver,
metered SaaS stub extension, burst/saas profiles, credits CLI, docs, and tests.

SCOPE.md

@@ -107,7 +107,8 @@ own tunnels or CAs.
 - **Workplans finished:** SAND-WP-0001–0005, 0008 (see `workplans/`)
 - **Package:** `src/sandboxer/` — CLI, manager, extensions, telemetry, HTTP API
 - **Profiles:** `profile.compose-e2e`, `profile.sandbox-canary`, `profile.vm-haskell-build`
-- **Extensions:** `ext.compose-ssh`, `ext.vm-packer` (attach mode)
+- **Extensions:** `ext.compose-ssh`, `ext.vm-packer`, `ext.saas-stub` (metered)
+- **Routing + payments:** `docs/routing.md`, `docs/payments.md`, `sandboxer credits`
 - **Registry:** `capability.execution.sandbox-provision` indexed (draft)
 - **Tests:** 26 pytest cases; `make check` green
 - **Sibling:** wise-validator ships `validate run` (SAND-WP-0003)
@@ -144,7 +145,7 @@ cd ~/the-custodian && make e2e REPO=activity-core
 - ~~`make e2e REPO=` shim~~ — done (SAND-WP-0004; delegates to `validate run`)
 - TTL auto-expiry / `extend_ttl` enforcement
 - ~~`ext.vm-packer` attach mode~~ — done (SAND-WP-0005); Packer build orchestration deferred
-- SaaS extensions (E2B, Modal) or payments layer (SAND-WP-0006)
+- Real E2B / Modal adapters (stub + payments v0 done in SAND-WP-0006)
 - Snapshot / restore / checkpoint profiles (SAND-WP-0007)
 - Formal ops-bridge tunnel attachment in reachability descriptor
 - Dedicated sandboxer01 host (CoulombCore interim only today)