Implement SAND-WP-0006: SaaS payments, routing, and ext.saas-stub

Add credits store, metering on create/destroy, extension routing resolver,
metered SaaS stub extension, burst/saas profiles, credits CLI, docs, and tests.

workplans/SAND-WP-0006-saas-extensions-and-payments.md

@@ -0,0 +1,86 @@
+---
+id: SAND-WP-0006
+type: workplan
+title: "SaaS extensions and payments layer"
+domain: infotech
+repo: sand-boxer
+status: finished
+owner: codex
+topic_slug: custodian
+created: "2026-06-23"
+updated: "2026-06-23"
+---
+
+# SaaS extensions and payments layer
+
+Deliver INTENT pillar 4 (payments/metering) and routing engine v0 for
+self-hosted vs SaaS backend selection.
+
+**Predecessor:** SAND-WP-0005 (extension SDK — finished)  
+**Follow-on:** SAND-WP-0007 (snapshots), real E2B/Modal adapters
+
+## Payments and credits
+
+```task
+id: SAND-WP-0006-T01
+status: done
+priority: high
+```
+
+`CreditsStore`, `estimate_cost` / `settle_usage`, pre-create balance check,
+post-destroy debit, `SandboxStatus.meter` field. Docs: `docs/payments.md`.
+CLI: `sandboxer credits show|add`.
+
+## Routing engine
+
+```task
+id: SAND-WP-0006-T02
+status: done
+priority: high
+```
+
+`RouteSpec` on profiles, `resolve_extension` with strategies
+(`prefer-self-hosted`, `lowest-cost`, `lowest-latency`, `explicit`).
+Docs: `docs/routing.md`.
+
+## ext.saas-stub
+
+```task
+id: SAND-WP-0006-T03
+status: done
+priority: high
+```
+
+Metered SaaS stub extension — `estimate_cost`, `meter_actual`, no external API.
+Profiles: `profile.saas-stub`, `profile.burst-sandbox`.
+
+## Manager integration
+
+```task
+id: SAND-WP-0006-T04
+status: done
+priority: high
+```
+
+`SandboxManager` uses routing resolver; destroy loads `status.extension_id`;
+meter settlement on destroy; meter events to State Hub.
+
+## Tests
+
+```task
+id: SAND-WP-0006-T05
+status: done
+priority: high
+```
+
+`test_routing.py`, `test_payments.py`, `test_saas_stub.py`.
+
+## Deferred
+
+```task
+id: SAND-WP-0006-T06
+status: wait
+priority: low
+```
+
+Real `ext.e2b` / `ext.modal` adapters, BYOK via OpenBao, fin-hub export.