#38 Remove deprecated Zod finite and passthrough calls

Summary

Remove 10 deprecated .finite() calls from numeric and document contracts and replace .passthrough() in the isolation script. Zod 4 already rejects non-finite numbers; z.looseObject() preserves unknown manifest fields.

-z.number().finite()
+z.number()
-z.object(shape).passthrough()
+z.looseObject(shape)

Keep .strict() and .superRefine() in this change. Installed Zod 4.6.5 typings do not mark them deprecated, and both remain supported. The online documentation describes .strict() as legacy and is inconsistent about .superRefine(); changing refinement callbacks to .check() needs a separate scope.

Closes #34.

Evidence

• Before: compiler API audit found 11 deprecated Zod references.
  After: the same audit of 168 TypeScript files found zero.
• Numeric parse results match for 17 boundary inputs, including NaN, infinities, unsafe integers and non-number values. Manifest validation and preservation of unknown keys also match.
• Core tests: 255 passed. Focused document-contract, preservation-fixture and ESM/CJS consumer integration tests: 27 passed.
• npm run typecheck passed for the root and all workspaces.
• npm run lint passed with warnings outside the changed files. All four changed files pass targeted lint and formatting checks.
• npm run test:isolation passed for all five projects, including independent builds, typechecks, tests and installed Python wheel verification.

Merge Danger

Door: two-way

Reversible schema API cleanup. Numeric constraints and manifest field preservation are unchanged.

Blast Radius: validation