Harden SDK wire decoding and resolve CodeQL findings

[ty-everett]

Summary

• construct wallet-wire records through Map and Object.fromEntries instead of untrusted computed property writes
• reject __proto__ and enforce the existing 1–50 UTF-8-byte certificate field-name contract at the wire boundary
• express deterministic Base58 remainders as quotient subtraction so CodeQL no longer treats conversion math as biased random sampling
• add adversarial wallet-wire tests and Base58 boundary round-trip coverage

This is the Wave 1c security follow-up in #324. It resolves current CodeQL alerts #205–#211 in code; no alert is dismissed or suppressed.

Validation

• SDK lint: pass (no errors; pre-existing warnings only)
• SDK build: pass (TypeScript dual package and UMD)
• focused tests: 133 passed
• full SDK suite: 5,715 passed, 3 skipped, 1 snapshot
• full SDK coverage: 92.04% lines / 82.93% branches
• repository health: pass (37 projects; existing 83 findings and 11 exceptions; 0 control errors)
• security audit: no known high-severity vulnerabilities
• version and codegen checks: pass; 9 generated files current
• conformance: 6,650 vectors across 74 files, 0 errors
• license policy: all 46 manifests use Open BSV License v6; all 30 public package tarballs contain the canonical license

Compatibility

Ordinary wallet arguments and public service behavior are unchanged. This PR does not alter CORS/CSP defaults, publishing, versions, or deployment behavior.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

APPROVED IN SUBSTANCE by ty-everett for admin merge.

Reviewed exact head 33e236d7f6f88b695a293e67df46daefd7ebc326 against Wave 1c of #324. The five wallet-wire findings are removed structurally via safe entry construction plus trust-boundary validation, and the two Base58 findings are removed through equivalent deterministic quotient/remainder arithmetic. Adversarial and regression coverage is present.

Evidence reviewed:

• all 31 exact-head checks are successful
• CodeQL JavaScript/TypeScript analysis is successful; the PR alert API returns 0 open alerts
• SonarCloud quality gate passes with 0 open/confirmed issues and 0 security hotspots
• Codecov reports every modified coverable line covered
• no dependency-review or Socket findings
• 0 unresolved review threads and no requested changes

GitHub prohibits an author from formally approving their own PR. This review records the required maintainer approval in substance; the admin merge is deliberate and authorized.