Implement SAND-WP-0006: SaaS payments, routing, and ext.saas-stub

Add credits store, metering on create/destroy, extension routing resolver,
metered SaaS stub extension, burst/saas profiles, credits CLI, docs, and tests.

extensions/README.md

@@ -46,4 +46,14 @@ Attach mode for pre-built VMs (`the-custodian/infra/build-machines/` lineage).
 
 **Profile:** `profile.vm-haskell-build` — see `docs/runbooks/profile-vm-haskell-build.md`.
 
-Packer build / OVA import remains operator-driven (not triggered by `create`).
+Packer build / OVA import remains operator-driven (not triggered by `create`).
+
+## ext.saas-stub
+
+Metered SaaS stub for payments and routing v0 (SAND-WP-0006). No external API.
+
+**estimate_cost / meter_actual:** credits check on create; debit on destroy.
+
+**Profile:** `profile.saas-stub` (explicit), `profile.burst-sandbox` (self-hosted fallback).
+
+See `docs/payments.md` and `docs/routing.md`.

extensions/ext.saas-stub.yaml

@@ -0,0 +1,15 @@
+id: ext.saas-stub
+title: SaaS sandbox stub
+description: >
+  Metered SaaS extension stub for payments and routing v0. No external API;
+  use for burst fallback testing before E2B/Modal adapters land.
+handler: sandboxer.extensions.saas_stub:SaaSStubExtension
+capabilities:
+  isolation_levels: [microvm]
+  regions: [us, eu]
+  persistence: true
+  pricing_model: metered
+config:
+  provider: saas-stub
+  rate_usd_per_hour: 0.12
+  session_fee_usd: 0.01