fix(reliability): normalize hostile DOCX callback failures without prototype inspection

[seonghobae]

Buyer-visible DOCX error-boundary defect

Draft PR #323 is the sole active writer for the framework-neutral DOCX import surface. Its public error boundary promises stable payload-redacted DocxImportError failures, but normalizeDocxImportError(error, fallback) currently identifies already-normalized errors with error instanceof DocxImportError.

JavaScript instanceof traverses the thrown object's prototype chain. A host callback used by public openDocx() can throw a Proxy whose getPrototypeOf trap itself throws private caller state; the normalizer then executes that trap while trying to redact the original failure, allowing the trap exception to escape instead of returning the stable editor_rejected_document category. The same normalizer is shared by import/decompression boundaries.

This is Inkspan-owned deterministic error normalization only. It adds no transport, persistence, authentication, authorization, tenancy, credentials, model/provider, network, migration, retention, deployment, durable audit, macro execution, or external-relationship authority.

Test-first acceptance

1. Continue only on Draft PR feat(docx): open and import bounded Word documents #323 / branch agent/docx-open-import-v2; do not create a competing DOCX writer. Freeze this lane if that exact branch/path moves independently.
2. RED through public openDocx(): import a normal bounded DOCX, then have the host validation callback throw a Proxy whose getPrototypeOf trap throws a distinctive private sentinel. Prove current production leaks that sentinel instead of rejecting with the stable payload-redacted DocxImportError / editor_rejected_document category.
3. GREEN without reflecting or inspecting unknown thrown objects: preserve true module-created DocxImportError instances by an internal side-effect-free brand that does not invoke caller traps; normalize every other thrown value directly to the supplied fallback category.
4. Preserve existing error codes/messages, subclass construction, stack/cause privacy posture, ordinary import failures, ZIP/XML/resource limits, successful DOCX import, and editor schema-validation/set-document semantics.
5. Do not stringify, enumerate, inspect prototypes/properties, hash, clone, or otherwise transform unknown thrown values merely to classify them.
6. Obtain hosted exact-head RED before production repair, then exact-head CI/Security/SAST/package DOCX consumer evidence and repository-owned 100% production statement/branch/function/line coverage on GREEN.

Integration boundary

Keep #323 Draft/unmerged while #118 owns the unchanged exact protected v0.6.0 source identity. Any #323 head/live-base movement invalidates predecessor proof.

[seonghobae]

Resolved on the existing sole DOCX writer PR #323, not on protected main. Exact hosted RED 137dad268c7604ee58b4fc177e10fd7e5daf8df7 added the public openDocx() hostile-Proxy callback regression; CI run 31900566164 failed as intended while Security/SAST passed. GREEN 7366c16954ef606270fa1dce028ce3dfc6d85fa6 replaced instanceof DocxImportError with the module-owned WeakSet brand, so genuine module errors are preserved without prototype inspection and every unknown thrown value is normalized directly to the stable fallback category. Current #323 head 26a3f19449d28f86c65be3a3680e5f661b36a13d still contains that repair and exact current checks include successful CI, Security, SAST, OpenCode, Noema, Strix, and coverage evidence; formal reviews and unresolved review threads are both zero. #323 remains Draft/unmerged because #118 freezes protected main for v0.6.0 publication, so this closure records active-PR completion rather than shipped protected-main truth.