fix: prevent prototype pollution during decode

[ckorhonen]

Summary

• materialize decoded object keys with own data-property writes so __proto__ does not invoke prototype accessors
• make safe dotted-path expansion use own-property checks and data-property writes
• add regression coverage for direct and expanded prototype-pollution payloads

Validation

• nvm exec 24 corepack pnpm run lint
• nvm exec 24 corepack pnpm run test:types
• nvm exec 24 corepack pnpm run test
• nvm exec 24 corepack pnpm run build
• /Users/ckorhonen/.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --codex-bin /Applications/Codex.app/Contents/Resources/codex

Autoreview result: clean, no accepted/actionable findings reported.