Verify complex JSON keys through signed evidence lifecycle

[aruintelligence]

Change

• Reproduce three real Python verification failures in valid signed JavaScript capsules: array-index keys, UTF-16 ordering of astral keys, and lone surrogate JSON escaping.
• Implement both existing byte rules in the Python verifier: canonicalJSONStringify enumerates array-index keys numerically, while receipt and audit hashes use lexical UTF-16 key order. Preserve all JavaScript receipt and capsule bytes.
• Add signed positive, tamper, and escaped duplicate-key cases; check the same unusual-key receipt through a real locked HTTP response, signed archive, migration, and exact-byte archive recovery.
• Document the byte-order distinction and remaining numeric subset.

Local verification

• npm test: 797 passed.
• Capsule: 22 project-authored cross-runtime cases; HTTP capture: 26 cases; archive, migration, shard, drill, repair, placement, API, upgrade, and link checks pass.
• 4,096 exploratory JS/Python serializer comparisons on 2,048 structured key/string samples showed zero mismatches. This sample is not a completeness claim.

All evidence here is generated by the project and does not establish independent certification or production safety.