[chhoumann]

Fixes #44.

Problem

An own __proto__ key in an eval result did not survive the trip to the caller.

• client.dev.evalJson(...) returned {"savedFeeds":{}}, so the key was silently dropped.
• client.dev.evalJsonAsync(...) timed out with reason still-pending. The operation had already finished in Obsidian.

Root cause

The in-app serializer copied entries into a {} literal. next["__proto__"] = value changes that object's prototype and does not create a key. On the sync path, JSON.stringify then skipped the missing key. On the async path, the swapped object was stored in the registry. Every poll read reserialized it, hit the non-plain-object check, and threw. The poll loop treated each of those throws as transient until the deadline expired.

Fix

• Serializer records are built with Object.create(null), so __proto__ is an ordinary own key.
• The client decoder already uses JSON.parse and Object.fromEntries. Both define the key as own data on an object whose prototype is Object.prototype, so a decoded result cannot pollute any prototype. The tests assert this.
• A poll read that throws inside Obsidian (DevEvalError) is deterministic, so it is now rethrown at once instead of being reported as still-pending.

Verification

Tested against a real Obsidian 1.13.7 instance started with obsidian-e2e start, using a consumer project that installs the packed tarball:

before:
evalJson:       {"savedFeeds":{}} ownProtoKey=false polluted=false
evalJsonAsync threw: DevEvalAsyncError The evalJsonAsync operation is still pending in Obsidian after 2000ms; ...
after:
evalJson:       {"savedFeeds":{"__proto__":{"title":"__proto__"}}} ownProtoKey=true polluted=false
evalJsonAsync:  {"savedFeeds":{"__proto__":{"title":"__proto__"}}} ownProtoKey=true polluted=false

The regression tests are committed before the fix and fail without it. They cover the sync path, the async path, and a poll read that fails in-app.