Phase 18 deferred items

Out-of-scope findings recorded during execution. They are not fixed in this phase.

18-07 (unit tests)

cart.RegisterDetailsParams has no reader (sm-paymentgateway-plugin). The function stores a typed parameter set in paramTypes, and its doc says a row whose parameters carry "_type": name decodes into the registered struct. Nothing reads paramTypes: decodeParameters always returns a map. No plugin or application calls RegisterDetailsParams today. Making typed details parameters work means Details has to hold a struct beside its map, which is a design decision rather than a test-exposed bug. There are two options for a later phase: implement the typed decode, or drop the function and its README mention. TestCartRegistry pins what exists now: the allowlist, duplicate names, the nil constructor, and a _type in a row stays plain data.
gofmt in sm-paymentgateway-plugin. mail_smoke_test.go (from plan 04) is not gofmt-clean. 18-05 noted this too. It is left untouched.