Harden structured-candidate JSON checkpoints

[isty2e]

Summary

This hardens the JSON-facing checkpoint boundary around structured candidates and CSA runtime snapshots.

• Structured-candidate serialization now escapes marker-shaped user mappings instead of treating them as byte markers, while keeping legacy marker payloads readable.
• Unsupported candidate payloads and non-finite float values now fail at the codec boundary with explicit errors.
• CSA checkpoint loaders now use stricter JSON validators for numeric fields, so booleans no longer slip through integer or float paths and non-finite values are rejected before they can corrupt restored state.

Testing

• uv run --python 3.11 --extra test ruff check pyproject.toml src tests
• uv run --python 3.11 --extra test basedpyright src tests
• uv run --python 3.11 --extra test pytest tests/spaces/test_space_candidate_serialization.py tests/csa/test_csa_checkpoint.py tests/csa/test_csa_growth.py tests/csa/test_csa_banking.py -q
• uv run --python 3.11 --extra test pytest tests/spaces tests/csa -q
• uv run --python 3.11 --extra test pytest tests -q