Freeze canonicalization v1 behavior

[jt55401]

Summary

• align all five bindings on v1 resource, parser, claim, and JCS error precedence
• reject negative zero and negative underflow consistently
• apply output ceilings after final canonical text normalization
• add shared adversarial fixtures, including numeric claim names and malformed surrogate JSON

Validation

• HTMLTRUST_TEST_SESSION_ID=canon_v1_final_20260828 CARGO_TARGET_DIR=/mnt/bulk/cargo-targets/htmltrust/canonicalization-v1-hardening-final-20260828 ./scripts/test-in-docker.sh
• all five bindings passed unit tests and all 123 shared conformance fixtures
• git diff --check