fix: address Copilot review round 16 — tie-breaking, const-aware gating, malformed declarations

- selectBranchIndex no longer stops when several branches share the supplied
  constant. A branch is dropped only when a supplied value CONTRADICTS one of
  its constants; the required-field and exclusive-name passes then run over the
  remaining candidates, so { version: 1, phone: "555" } resolves to the SMS
  branch instead of falling back to the first.
- hasMissingRequiredFields counts only the branches the values could be making
  (new branchAcceptsValues): { kind: "sms", address: "x" } supplies
  everything the EMAIL branch requires while contradicting its discriminator,
  and would otherwise enable a submit the server refuses.
- convertToolParameters ignores a malformed property declaration when branches
  agree on a type, rather than storing a non-schema as the coercion schema.

Signed-off-by: cliffhall <cliff@futurescale.com>

core/json/jsonUtils.ts

@@ -178,9 +178,13 @@ function coercionProperties(
     // specialization of a root property carries the root's keywords too.
     const declarations = branches
       .filter((branch) => branch.declaredFields.includes(name))
-      .map((branch) => branch.schema.properties?.[name]);
+      .map((branch) => branch.schema.properties?.[name])
+      // A malformed declaration (`properties: { x: null }`) is not a vote about
+      // the type, and storing it as the coercion schema would put a value that
+      // is not a schema where one is expected.
+      .filter((schema) => typeof schema === "object" && schema !== null);
     const types = new Set(declarations.map((schema) => typeNameOf(schema)));
-    if (types.size === 1) {
+    if (types.size === 1 && declarations.length > 0) {
       Object.defineProperty(properties, name, {
         value: declarations[0],
         writable: true,