fix: close sanitizer and registry merge critical paths

[cursor]

Bug and impact

• Deeply nested percent-encoded prompt-injection phrases could exhaust the bounded canonicalization loop and be classified as clean.
• Structured registry source_ref metadata accepted arbitrary fields and non-string lang, allowing sensitive metadata to persist in snapshots and malformed local SSOT data to crash registry projection.
• Registry merge persistence could partially update SSOT/projection when one output write failed, leaving retries unable to regenerate the missing/stale side.

Root cause

• Canonicalization stopped after the max decode depth without fail-closing when another decode would still change the scan text.
• source_ref was open-ended in both runtime validation and schema despite only lang being used for multilingual projection.
• apply_merge() wrote merge outputs directly rather than staging both files and validating merged local state before persistence.

Fix

• Add an encoding_depth finding and classify exhausted canonicalization as injection.
• Close source_ref validation/schema to optional bounded lang metadata.
• Validate merged SSOT records before projection and stage projection/SSOT JSON writes with rollback on paired-write failure.
• Add regression tests for all confirmed trigger scenarios.

Validation

• PYTHONPATH=src python3 -m pytest -q tests/test_sanitize_encoding_evasion.py tests/test_registry_contribute_r3.py tests/test_pattern_record_r1.py tests/test_registry_fetch_r4.py tests/test_registry_ssot.py tests/test_security_regressions.py -> 128 passed.
• git diff --check -> passed.
• PYTHONPATH=src python3 -m pytest -q -> 287 passed / 3 skipped / 3 failed; failures are the pre-existing vendored contract hash mismatches in tests/test_contract_document_hash.py noted in automation memory.