fix(core): reject negative DeepSeek coordinates

[linhongyu510]

Summary

• preserve coordinate signs when parsing DeepSeek grounding responses
• reject negative point coordinates instead of silently converting them to positive values
• reject negative bbox coordinates in every position
• add regression coverage while preserving supported coordinate separators

Problem

The DeepSeek coordinate parser previously extracted values with /\d+/g. As a result, a model response such as [-10, 500] was silently interpreted as [10, 500], allowing malformed grounding output to become a valid click coordinate.

The same issue affected bbox responses: a negative edge could lose its sign before the shared coordinate-range validation saw it.

Changes

The parser now preserves an optional sign while extracting integer values and rejects any negative coordinate before returning normalized values. Existing support for bracket variants and flexible separators is unchanged.

Regression tests cover negative values in both point positions and all four bbox positions.

Validation

• DeepSeek adapter tests: 20 passed
• Core build type-check: passed
• Biome: 1604 files passed