Reduce diagnostics publication overhead

[nicodes]

Follow-on for https://github.com/aviorstudio/fieldsofrevik/issues/174.

Scope

• merge sensitive-key and JSON-safety checks into one cycle-safe iterative traversal
• cache documented Godot 4.7 JavaScriptObject interfaces per browser owner
• retain synchronous state/event publication, event detail/order, full element-map replacement, owner cleanup, ordinary-export isolation, and explicit diagnostic allowlists
• bump addon metadata to 0.0.6; no configuration changes

Controls and local evidence

• differential old/new corpus: valid nested/deep JSON, nested secrets, non-string keys, NaN, infinity, unsupported Object; decisions match, with cyclic input newly bounded/rejected before publication
• reachable call-count control: one receiver construction per owner and one combined event backend operation instead of repeated JavaScript source compilation; no game-performance claim
• Godot 4.7.2: four suites PASS; runner controls PASS
• Go 1.24.13 PASS; Bun 1.2.23: 5 tests/14 assertions PASS; package controls PASS
• exact ZIP lifecycle PASS; ZIP SHA-256 b8e1470a35274d39890decd4cb9dd8080f469ab10ab749971f443450ce0db409
• playwright-cli 0.1.18 exact packaged ordinary/diagnostic web exports PASS; ordinary globals absent, diagnostic allowlists/cleanup/input preserved; named sessions closed
• exact-head CI and GitHub-hosted refreshed screenshots: pending

Castledrop adoption and five-pair measurement remain independently deferred; this PR does not claim the 3% game budget.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Exact-head acceptance evidence

• Head c2cf94bf7ad2232113bbaa2c0f4832b2cbeb495c; CI PASS: https://github.com/aviorstudio/gd-playwright/actions/runs/34789086739
• Differential policy corpus preserves accepted/rejected decisions for valid nested/deep JSON, shared-container DAG aliasing, nested sensitive keys, non-string dictionary keys, NaN/infinity, and unsupported objects. Cycles are bounded and rejected. Rejected payloads produce no receiver operation.
• Cached receiver controls prove one construction per owner, invalidation on a new owner, and one event publication operation while preserving synchronous state, event detail/order, full-map coordinates/replacement, and owner cleanup. No game-level performance result is claimed.
• Exact packaged browser artifacts were personally inspected: ordinary identity 28aff13d5dfc111372c8e59daeeab84f64c80a1874c601f5f75eab6aab0c616e; diagnostic identity 0806f2fe1175f701aabb514168471a09525ed13b3d7c87caea94418566ddcfb6.

Ordinary release export

Diagnostic release export

Evidence images are the downloaded artifacts from the exact-head CI run above; the separate immutable evidence commit does not alter the PR head.