fix(reliability): reject malformed autosave queue options before key enumeration

[seonghobae]

Buyer-visible autosave reliability boundary

Protected main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03 exposes framework-free createDocumentAutosaveQueue(options). Its exact-options validator currently calls Reflect.ownKeys(options) before inspecting the required fixed save descriptor. A malformed host result such as { save: 1 } wrapped by a Proxy can therefore execute a caller-controlled ownKeys trap (or materialize arbitrary key metadata) even though the required save field already proves the options can never be accepted.

The host owns persistence/transport; Inkspan owns deterministic validation of the callback configuration it retains. This is local validation/resource hardening only and adds no transport, persistence, authentication, authorization, tenancy, credentials, network, model/provider, migration, retention, deployment, or durable-audit authority.

Test-first acceptance

1. Start from the independently resolved protected main generation and own only src/autosave/package.ts plus a dedicated autosave option-preflight regression. Freeze if another writer begins targeting either path.
2. RED through public createDocumentAutosaveQueue(): provide a Proxy whose underlying own save data property is non-callable and whose ownKeys trap records/throws. Require the existing redacted invalid_options error and prove protected production invokes ownKeys before recognizing the invalid required capability.
3. GREEN: inspect the required save own-property descriptor before global own-key enumeration. If it is absent, non-enumerable, accessor-backed, or non-callable, reject immediately without Reflect.ownKeys().
4. Only after the required save capability is valid may exact-key-shape validation enumerate keys and validate optional onSnapshotChange. Preserve unknown-key/symbol/non-enumerable/accessor/reflection-failure rejection and do not invoke accessors.
5. Preserve accepted queue behavior, callback receiver/value identity, detached evidence semantics, observer isolation, single-flight ordering, lifecycle snapshots, framework-free packaging, and stable payload-redacted errors.
6. Maintain exact 100% owned-production statement/branch/function/line coverage plus package/browser/Office/Security Scan/SAST and applicable central required-workflow evidence on the final exact head.

Integration boundary

Keep this next-release repair Draft/unmerged while #118 owns the unchanged protected v0.6.0 publication/provenance source identity. Any head/live-base movement invalidates predecessor evidence; pending/queued/skipped/cancelled/absent/predecessor/status-only evidence is non-passing.

[seonghobae]

Resolved on the existing sole autosave option writer PR #354, not on protected main. Exact test-only RED 007875dbce37d76bdc1a14b175b5f12d91b1c02c / CI 31917450492 proved createDocumentAutosaveQueue() invoked the hostile Proxy ownKeys trap before rejecting a non-callable required save. Current GREEN head 735602a30af207955b9550b638ffa0d717a1be8b preflights the mandatory own save descriptor before global key enumeration and preserves fail-closed exact-shape/optional-callback validation. Fresh exact-head evidence includes successful repository CI, Security Scan, SAST, Strix, OpenCode, Noema, and coverage checks; formal reviews and unresolved review threads are both zero. #354 remains Draft/unmerged because #118 freezes protected main for v0.6.0 publication, so this closure records active-PR completion rather than shipped protected-main truth.