cmcp_runtime.provenance: check_server_provenance accepts duplicate JSON keys and private JWK parameters, crashes on non-dict JSON or non-str fields, and meets() does not validate required_kind #813

Summary

1. check_server_provenance in src/cmcp_runtime/provenance.py parses record_path with bare json.loads (accepting duplicate JSON keys and NaN/Infinity). When the parsed JSON is a list/int/string instead of a dict, record.get("kind") raises AttributeError, violating the documented no-raise contract.
2. When record["kind"] or record["publisher"] is not a str, ProvenanceResult.to_audit() raises TypeError on self.publisher[:256], and ProvenanceResult.meets(required_kind) does not validate required_kind in _KIND_ORDER when outcome != VERIFIED (and raises ValueError when self.kind not in _KIND_ORDER).
3. check_server_provenance does not reject trusted_jwk dicts containing private or symmetric JWK parameters ("d", "p", "q", "dp", "dq", "qi", "oth", "k").