refactor(core): share canonical JSON serializer with eval and storage

[seekskyworld]

Fixes #4927

Summary

• expose the existing strict canonical JSON serializer through @maka/core/canonical-json
• replace the eval experiment and session-bundle manifest serializer copies
• preserve eval's trailing newline and collision behavior
• map manifest serializer failures back to SessionBundleFileError('invalid_manifest', ...)

Motivation

Eval identities and portable bundle bytes were produced by separate serializers. Sharing the strict core authority keeps key ordering and rejection of unsupported JSON values consistent across both persistence boundaries.

Validation

• npm --workspace @maka/core run build
• npm --workspace @maka/runtime run build
• npm --workspace @maka/runtime-host run build
• npm --workspace @maka/eval run build
• npm --workspace @maka/storage run build
• node --test packages/core/dist/tests/canonical-json.test.js packages/core/dist/tests/tool-args-identity.test.js packages/eval/dist/tests/experiment-directory.test.js packages/storage/dist/tests/session-bundle-manifest.test.js (16/16)
• npx biome check on changed sources and tests

[hqhq1025]

Reviewed all six changed files at 8c1a5e8. No substantiated P0–P3 finding.

The new core/canonical-json subpath re-exports the existing serializer unchanged. Eval and Storage remove two local serializers; Storage retains schema validation and its stable invalid_manifest error. This is not completely behavior-neutral for Eval: newly written experiment files can have different key order, and invalid JavaScript values such as NaN are rejected rather than coerced. Existing files are parsed and compared canonically without rewriting them. The CLI already validates its JSON input before this call.

Validation: 16 focused exact-source tests and four independent production probes passed. I compared 32 valid Manifest V1 cases with the actual base producer, including Unicode, optional activation provenance and numeric boundaries; all encoded bytes were identical and cross-decoding succeeded. A legacy experiment file with differently ordered numeric/case/accented keys reopened unchanged; changed specs still rejected. Concurrent conflicting writers retained one winner, and invalid input left no partial experiment file. Replacing the shared serializer with ordinary JSON.stringify caused six regression tests to fail across core, Eval and Manifest, confirming the checks exercise the changed consumers.

The local tests used current-head TypeScript through an esbuild source loader, not a full local build/typecheck. Hosted test and audit are successful on this exact head; GitHub reports MERGEABLE/BLOCKED. Refactoring direction remains a human decision, and this automated source review does not grant merge or product acceptance.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.