fix: snapshot supported client options once

[tensornull]

What changed

• copy supported constructor and withOptions values through an explicit own-key snapshot
• exclude forbidden route/auth/browser keys without a second accessor read
• restore the regression assertion that each forbidden accessor is read exactly once across Node 22, 24, and 26

Why

The first repair used object-rest after validating forbidden fields. Node 22/V8 reads an excluded accessor twice during that operation. It did not forward or enable the forbidden value, but an explicit snapshot makes the fail-closed behavior deterministic and removes the runtime-specific read count.

Validation

• Node 22 targeted configuration tests: 14 passed
• Node 24 targeted configuration tests: 14 passed
• Node 26 full suite: 13 files, 276 tests passed
• format, lint, typecheck, and git diff --check passed.

[tensornull]

Superseded by #32, which carries the same options snapshot fix together with the reviewed Release Please hardening. The branch is retained.