chore(commerce): drop attacker-controlled rationale from pi_cache docstring

Replace "Prevents agents from sending payment to an attacker-controlled
address and replaying the credential" with the behavior-only equivalent
("Validates the credential's deposit address against the addresses the
merchant has actually minted"). Mirrors the node-commerce pi-cache.ts
sweep.

Author: vvillait88

agentscore_commerce/stripe_multichain/pi_cache.py

@@ -4,8 +4,8 @@
 
 1. **Is this on-chain ``pay_to`` address one we minted?** — when an MPP credential
    arrives with a ``recipient``, verify it matches a recently-minted Stripe deposit
-   address. Prevents agents from sending payment to an attacker-controlled address
-   and replaying the credential against the merchant's endpoint.
+   address. Validates the credential's deposit address against the addresses the
+   merchant has actually minted.
 
 2. **Which PaymentIntent owns this deposit address?** — when settling, the
    ``simulate_crypto_deposit`` test_helpers call needs the PaymentIntent id for the