Reject malformed admission policy JSON before serving requests #704

Malformed admission JSON is silently decoded to an empty map. An operator can intend a per-namespace request limit and instead serve without that override. This is a product validation defect; documenting the fallback is not the resolution.

The Website owner reproduced the behavior on published PHP Server 2.11.0, immutable image durableworkflow/server@sha256:b29157eb2cf844916debbbb3c01b3257672e0dece778a9c6fa539043a3038f02, with normal bootstrap, authenticated HTTP and DW_ENV_AUDIT_STRICT=1: valid {"default":{"max_requests_per_minute":1}} gives successive 200/429 responses, while the same JSON missing its final brace gives 200/200. Other defaults and hard caps were unset. Existing configured hard caps were not bypassed. Original evidence: durable-workflow/durable-workflow.github.io#335, comment 6369150521.

config/server.php decodes several admission/durable-state/payload-policy maps without checking JSON errors. Invalid syntax therefore disappears before the policy validator sees it. Strict environment auditing currently checks names and aliases, not the validity of these values.

Acceptance:

• Reject malformed JSON and non-object JSON for the existing queue-admission, namespace-request, namespace-durable and payload-namespace policy maps during normal configuration/bootstrap. Do so regardless of the unknown-variable audit mode; malformed policy must not become an unlimited default.
• Preserve omitted settings, explicit empty objects, valid policies, current DW-over-legacy precedence and existing policy/hard-cap semantics. An invalid primary must not silently select a valid legacy fallback.
• Identify the failing environment variable without echoing its potentially sensitive value.
• Add original/corrected process controls and focused configuration tests, including primary/legacy input and shape errors. Verify valid rate limiting still returns 429 through the normal published image after release.
• Update the Server reference and the all-locale Website guidance after actual delivery; coordinate native parity without changing frozen references.

General owns the PHP correction. No SDK, schema, Composer, native/shared runner or frozen-reference edit is implied. Publication and normal installed-image verification remain required before closure.

Current source: draft #705 at 545f2576a, after tests-first d8d8cb76a. Constructed real configuration loads with installed PHP 8.3.36/Laravel produce 24 pass / 54 fail before, then all 78 pass after. PHP syntax and diff checks pass. Normal hosted source checks and actual published-image bootstrap/HTTP remain pending; this is not a deployed fix. The initial isolated harness had no Foundation Application binding and failed before assertions; its runner error is retained separately.