fix: reject prototype paths, fail closed on deny, and run unit tests in CI

[martijn00]

Summary

• stacks on #67; review the last commit(s) once perf: enforce bundle budgets and narrow React checks #67 merges
• reject inherited Object.prototype names and __proto__ hydrate keys so check() cannot authorize via the prototype chain
• freeze a null-prototype copy of rules on setup() / hydrate() so mutating the caller object or getRules() cannot change authorization
• fail closed in Fastify and Elysia after deny; forward Express 4 / Node async middleware rejections to next(err)
• treat empty-subtree ~all as deny, and run pnpm test on every PR

Test plan

• pnpm exec vitest run src/core src/fastify src/elysia src/express src/node src/extractor
• pnpm test
• pnpm run check-types
• pnpm run lint
• pnpm run format:check

Checklist

• added regression tests for inherited names, __proto__ hydrate, empty ~all, reserved extractor segments, no-op onForbidden, and rejecting setup
• no Permix public API or integration guidance change requiring skill updates

[vercel]

@martijn00 is attempting to deploy a commit to the letstri Team on Vercel.

A member of the Team first needs to authorize it.