refactor(json-document): harden state publication boundaries

[developer-1px]

Summary

• Enforce the JSON-only state boundary and own every accepted ingress value before publication.
• Publish transitively immutable snapshots and canonical patch records without changing the public API.
• Keep patch, history, and selection metadata publication-local across reentrant subscribers.
• Harden RFC 6901/6902 pointer validation and isolate custom schema validation from live state.
• Preserve large-document performance with path-local and identity-diff sealing of copy-on-write graphs.

Verification

• npm run verify -w @interactive-os/json-document — 505 passed, 4 skipped; layers, typecheck, build, and package smoke passed
• npm run docs:evaluate
• npm run standard:check — 6 passed
• npm run perf:core
  • frozen trusted 50k state, copy 1,000 + first snapshot: p50 6.83ms (<15ms)
  • warm 50k-key state, replace 1,000: p50 14.39ms (<20ms)
• npm run pack:library

Compatibility

• Public entrypoints, exported types, package metadata, and public-contract.json are unchanged.
• trustedInitial keeps identity-preserving reuse for frozen roots; only statically known-JSON schemas skip the JSON scan, while custom/refined schemas retain the JSON boundary check.