fix(core): reject unsupported dictionary unpacking in safe_expr

[tonghzhang]

Condition.safe_expr("bool({**{}})") currently returns true: dictionary unpacking passes validation, but the interpreter treats its AST sentinel as a literal None key. Similarly, a membership condition such as 'allowed' in {**mapping} silently returns false even when mapping contains that key.

Changes

Reject unsupported dictionary unpacking when constructing the condition, matching the existing rejection of other unpacking forms. Document the restriction and cover plain, mixed, repeated, nested, and short-circuited unpacking, plus a valid literal None key.

How I tested this

• The five new rejection cases fail on the original implementation and pass after the fix.
• python -m pytest tests/core/test_action.py -q: 160 passed.
• Broader tests/core run: 402 passed; four existing graph-rendering tests failed because the local Windows environment has no Graphviz dot executable.
• Repository pre-commit hooks passed for both changed files (the frontend-only hook was skipped), including Black, isort, flake8, Python AST, whitespace, and ASF headers. git diff --check also passed.

Notes

Prepared with OpenAI Codex assistance; the regression and broader test results above were run locally. The commit includes a Generated-by trailer.

Checklist

• PR has an informative and human-readable title
• Changes are limited to a single goal
• Any change in functionality is tested
• The public API docstring describes the restriction