fix(id/web): detectLanguage own-key guards — prototype names are not languages (#2787) - #2788

Fixes #2787

detectLanguage() looked up arbitrary filename extensions/stems in the plain-object maps EXT_TO_LANG / FILENAME_TO_LANG with truthiness checks, so inherited Object.prototype members counted as hits: notes.constructor returned the Object constructor function and notes.__proto__ returned a prototype object as the file's "language" (declared return type string | undefined). The LANG_IMPORTS lookup in ensureLanguage had the same flaw for an authored code-block language attribute — constructor was actually called as an import function.

Fix: own-key (Object.hasOwn) guards at all three detectLanguage lookup sites and at the LANG_IMPORTS lookup in ensureLanguage. Unknown/prototype names now fall through to undefined / "language not in registry" as intended.

Verification (laptop worktree, off main 24ddc15):

• Probe importing the real module before the fix reproduced all four bad returns; after the fix all return undefined, controls (app.ts → typescript, Dockerfile → dockerfile, unknown ext) unchanged. Probe: ~/git/fleet/probe-2026-10-30-laneB-highlightproto/
• vitest run src/highlight.test.ts: 99/99 pass (2 new tests cover the prototype extension and filename paths)
• tsc --noEmit: clean

^{Need help on this PR? Tag @codesmith-bot with what you need.}