Agents never hold a key: Algebra pays from a wallet it controls, inside limits you set. How that works