fix: address Copilot review round 23 — inherited constants, branch null forms, test cast

- matchesConstants checks own-property presence before reading a supplied
  value, so an absent argument legally named `constructor` no longer reads the
  inherited one and rules out every branch pinning that name.
- anyOfAdmitsNull asks `admitsNull` about each composition-free branch instead
  of testing `type` alone, so a branch spelling its nullability as
  `{ const: null }` or `{ nullable: true }` is recognized. Refusing composed
  branches is what bounds the recursion.
- Drop a double cast from the malformed-applicator fixture.

Signed-off-by: cliffhall <cliff@futurescale.com>

core/json/jsonUtils.ts

@@ -240,6 +240,9 @@ function matchesConstants(
     if (typeof schema !== "object" || schema === null) return true;
     const constValue = (schema as { const?: unknown }).const;
     if (constValue === undefined) return true;
+    // `hasOwn`: an absent argument legally named `constructor` would otherwise
+    // read the inherited one and rule out every branch that pins that name.
+    if (!Object.hasOwn(params, name)) return true;
     const supplied = params[name];
     return supplied === undefined || supplied === String(constValue);
   });