fix(rpc): close prototype-chain permission bypass, add server/client/transport tests

C1 CRITICAL: implement() looked up procedures/handlers with plain property
indexing, so any Object.prototype member name (constructor, toString, etc.)
resolved truthy and skipped the permission gate entirely. Fixed with
Object.hasOwn checks in packages/rpc/src/server.ts. Defense-in-depth guard
added in packages/dev-server/src/rpc-dispatch.ts constraining URL path
segments to a safe charset before they reach service/procedure lookups.

Added missing direct test coverage for packages/rpc/src/transport.ts,
server.ts and client.ts (previously untested), including a prototype-name
sweep in both server.test.ts and dev-server's rpc-endpoint.test.ts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/dev-server/test/rpc-endpoint.test.ts

@@ -48,4 +48,29 @@ describe("RPC endpoint", () => {
     expect(isInternalCaller(forwarded)).toBe(false);
     expect((await handleRpcRequest(forwarded, new URL(forwarded.url), services))!.status).toBe(404);
   });
+
+  describe("C1: prototype-chain procedure names cannot bypass the permission gate", () => {
+    const PROTO_NAMES = [
+      "constructor",
+      "toString",
+      "valueOf",
+      "hasOwnProperty",
+      "__proto__",
+      "isPrototypeOf",
+    ];
+
+    for (const name of PROTO_NAMES) {
+      test(`"${name}" in the URL path yields RPC_UNKNOWN`, async () => {
+        const req = request(`/__wrnexus/rpc/demo/${name}`, { "x-wrnexus-internal": "1" });
+        const res = await handleRpcRequest(req, new URL(req.url), services);
+        expect(await res!.json()).toMatchObject({ ok: false, code: "RPC_UNKNOWN" });
+      });
+    }
+
+    test(`"constructor" as the SERVICE segment also yields RPC_UNKNOWN`, async () => {
+      const req = request("/__wrnexus/rpc/constructor/add", { "x-wrnexus-internal": "1" });
+      const res = await handleRpcRequest(req, new URL(req.url), services);
+      expect(await res!.json()).toMatchObject({ ok: false, code: "RPC_UNKNOWN" });
+    });
+  });
 });