.hyperaudio parity: filename rules, envelope preservation, byte caps, STORE enforcement (#403 Phase A)

[maboa]

Part of the #403/#404 Phase A push. The .hyperaudio reader/writer in #404 diverges from the format's reference behavior in ways that break cross-implementation round-trips. All fixes are contained and testable against the shared fixture suite (spec repo).

1. Media path validation: reject /, \, and the exact segments ./.. — but permit .. as a substring (mix..final.mp3 is legal). The current any-substring rejection makes conforming containers written elsewhere unreadable; this exact bug class has already occurred in the wild once.
2. Sanitize media filenames with one sanitizeMediaFilename() shared by descriptor construction, OPFS storage, and ZIP entry creation — writer and reader must share the rule.
3. Envelope preservation: keep the parsed raw envelope in the session; on save, structuredClone it and overwrite only editor-owned fields (merge owned keys inside known nested objects). Unknown top-level and nested fields must survive an open→save round trip.
4. Text caps in UTF-8 bytes: read entries as uint8array, enforce the 50 MB cap on bytes, decode with new TextDecoder('utf-8', {fatal: true}) so invalid UTF-8 is rejected consistently.
5. Reject non-STORED media entries (or enforce a strict streaming size cap) — matching the format's requirement and avoiding JSZip private-field reliance.

Acceptance: the shared fixtures (legal .. names, unicode/hostile names, unknown fields, newer minors/majors, invalid UTF-8, compressed media, oversized text, link media, missing media, captions variants, original-transcript preservation) pass in both directions.

[maboa]

Landed on the #404 branch as 71a8332:

• Normative spec extracted to docs/hyperaudio-format.md as v1.2 (freeze decisions: media.kind: "none" § 7.2.2; writer envelope preservation § 8.1; path segment rule § 10.2; UTF-8 byte caps § 10.3; STORE-only media on read § 7.1; app/session identity excluded § 9).
• All five parity fixes from this issue implemented in js/hyperaudio-save.js with unit coverage (24 module tests: the legal .. substring, shared sanitizeMediaFilename — an unsanitized ../evil.wav previously produced literal traversal entries in the archive — unknown-field preservation incl. two-deep nesting, fatal UTF-8, compressed-media rejection pinning JSZip's metadata access).
• docs/format-fixtures/README.md documents the conformance matrix, currently executable-first in the unit lane.

Remaining for this issue: generate the matrix as checked-in .hyperaudio files + expectations manifest so non-JS implementations consume it without this repo's harness.

[maboa]

Shipped in the Phase A merges (#404 → 1.0.x) and verified against current main: exact-segment media path rule (unit-tested against the ..-substring regression class), one shared sanitizeMediaFilename across descriptor/OPFS/ZIP, text-entry byte caps, STORE enforced on read, and § 8.1 envelope preservation with a round-trip test. Closing.