fix(sheaves): use Object.hasOwn in decomposeMetadata to avoid prototype chain

Replace `key in obj` with `Object.hasOwn(obj, key)` in two places inside
decomposeMetadata:

- Sharing check (line 127): `key in meta` would pass for prototype-inherited
  names (e.g. 'constructor'), causing a key to be treated as present in a
  candidate that does not own it. If the inherited value also happens to match
  via Object.is, the key is wrongly promoted to a shared constraint.

- Stripping step (line 137): `key in constraints` is true for prototype
  property names on an empty {} object, so any metadata key that shadows a
  prototype name gets silently dropped from stripped candidates even when it
  was never added to constraints.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: grypez

packages/sheaves/src/sheafify.ts

@@ -124,7 +124,7 @@ const decomposeMetadata = <MetaData extends Record<string, unknown>>(
     const val = first[key];
     const shared = candidates.every((entry) => {
       const meta = entry.metadata;
-      return key in meta && Object.is(meta[key], val);
+      return Object.hasOwn(meta, key) && Object.is(meta[key], val);
     });
     if (shared) {
       constraints[key] = val;
@@ -134,7 +134,7 @@ const decomposeMetadata = <MetaData extends Record<string, unknown>>(
   const stripped = candidates.map((entry) => {
     const remaining: Record<string, unknown> = {};
     for (const [key, val] of Object.entries(entry.metadata)) {
-      if (!(key in constraints)) {
+      if (!Object.hasOwn(constraints, key)) {
         remaining[key] = val;
       }
     }