[BUG]: v0.9 message processor skips envelope schema validation and commits unknown component types

# v0.9 message processor skips envelope schema validation and commits unknown component types

Repository: https://github.com/a2ui-project/a2ui
Affected: `@a2ui/web_core` v0.9 processing path (verified on 0.10.6)
CWE: CWE-20 (Improper Input Validation)

## Summary

`processMessages` never parses the incoming message envelope against the v0.9 JSON schema (in contrast, the v0_8 `model-processor.ts:110` does parse). Additionally, components with types not present in any catalog skip property validation but are still committed to the components model and trigger `onCreated` events.

## Affected code

- `renderers/web_core/src/v0_9/processing/message-processor.ts:276-316` — no envelope parse
- `:359-380` — validation skipped for unknown component types
- `:384-404` — unconditional commit to the components model + `onCreated`

## Observed behavior (published package 0.10.6)

`updateComponents` with `{id: 'root', component: 'NotInAnyCatalog', evilPayload: {x: 1}}` was accepted and stored in the surface's components model without any error.

## Impact

The three current renderers render unknown component types as nothing, so there is no direct exploit path today. The issue is a defense-in-depth gap: any current or future consumer of `componentsModel` inherits fully unvalidated agent-controlled properties.

## Suggested remediation

Parse the message envelope against the v0.9 schema on receipt, and reject (or strictly validate) component types that are not in the configured catalogs.