[BUG]: v0_8 read path resolves JSON pointers through ordinary-object prototype chains

# v0_8 read path resolves JSON pointers through ordinary-object prototype chains

Repository: https://github.com/a2ui-project/a2ui
Affected: `@a2ui/web_core` v0_8 processing
CWE: CWE-200 (Exposure of Sensitive Information — read-path traversal)

## Summary

The v0_8 model processor resolves JSON Pointer reads by walking plain objects (`current[segment]`, `model-processor.ts:356-377`). Properties inherited through the prototype chain (e.g. `Object.prototype` built-ins) are therefore reachable by agent-supplied paths.

Notes on scope:

- The v0_8 **write** path is Map-based and unaffected.
- The v0_9 path rejects dangerous keys (`__proto__`/`constructor`/`prototype`) after unescaping.

## Impact

Agent-supplied paths may resolve to inherited values (e.g. a `toString` function) instead of data-model values, causing unexpected types to flow into bindings and expression evaluation. No modification/write primitive was found — this is read-path behavior only.

## Suggested remediation

Resolve reads with `Object.prototype.hasOwnProperty` checks, or store values in Maps consistent with the write path.

El problema se encuentra en la ruta de lectura del procesador de modelos v0_8, específicamente en `model-processor.ts`, en las líneas 356-377. Empieza examinando cómo `current[segment]` resuelve las propiedades. Es probable que la corrección implique usar `Object.prototype.hasOwnProperty` para comprobar que las propiedades sean propias antes de acceder a ellas, o cambiar a un almacenamiento basado en Map coherente con la ruta de escritura. Ejecuta las pruebas existentes para asegurarte de que la corrección no rompa la funcionalidad existente y verifica que las propiedades heredadas, como `toString`, ya no sean accesibles mediante rutas proporcionadas por el agente.

Escrito por el modelo de indexación a partir del texto del issue.