GhostBus v0.5.4 — hardening round 3: hostile input

Hardening round 3 — hostile input. An audit-first round: two surfaces proved already safe (with tests pinning them), three real bugs closed.

Closed

• Planted-registry path escape. Hosted create/import already validated workspace ids strictly, but the registry loader trusted registry-file keys blindly — a planted ../escape entry made the server load a state file OUTSIDE the data dir. The registry is now filtered through the id rule at load (invalid entries ignored with a warning) and ids are re-checked before becoming paths.
• __proto__ file-store corruption. putFile('__proto__') invoked the prototype setter on the files map and silently corrupted the store (the file existed nowhere enumerable). Reserved names (__proto__, constructor, prototype) are now refused at write, treated as absent at read/delete, and refused in snapshots. A channel named __proto__ also silently lost its message counts — fixed.
• Snapshots that brick the bus. Validation was shallow: agents: [null] passed and then crashed every subsequent operation. The validator now deep-checks entry shapes (objects, string names, string file text, finite non-negative counters, context shape) with sanity caps far above the bus's own trims. Legitimate exports from v0.5.0–0.5.3 still import and round-trip — compatibility was a hard constraint (unknown extra top-level keys remain allowed, deliberately, for forward compatibility).

Proven already safe (now pinned by tests): hosted id traversal at create/import was already refused; bus file names are pure state keys (hostile names incl. NUL bytes store/return inertly); the admin audit log can't be CR/LF-injected; global prototype pollution was not reachable through any state entry point.

Verified: 59 checks (was 54 — the 5 new checks all fail on v0.5.3 for exactly the intended reasons), serverless 6/6, both demos.