fix(core): reject malformed array path indexes

[simonyang08]

Summary

• reject malformed or unsafe array-index tokens instead of coercing them with parseInt
• preserve arbitrary JSON Pointer member names when traversing objects
• align immutable state-store writes with the same array semantics and no-op behavior
• add regression coverage for mutable helpers, canonical indexes, object keys, and state-store notifications

Fixes #326

Test plan

• pnpm test (66 files, 1082 tests)
• pnpm lint
• pnpm --filter @json-render/core build
• pnpm exec vitest run packages/core/src/types.test.ts packages/core/src/state-store.test.ts (138 tests)

Environment note

The full pnpm type-check reaches the workspace build graph but cannot complete on Windows because @json-render/next invokes rm -rf dist. The focused core build, declaration generation, lint, and tests pass.

[vercel]

@ppt5928-dot is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.