feat(8.0): reserved-field enforcement — reservedFieldPolicy defaults to throw

An untyped (JS) caller that smuggles a Brainy-reserved field (confidence,
weight, subtype, visibility, service, createdBy, noun/verb, data, createdAt,
updatedAt, _rev) inside a write-path metadata bag previously got a silent
remap-or-drop — a class of bug where confidence-evolution writes no-oped for
weeks before being caught on read-back. 8.0 closes this with no silent failures.

- New BrainyConfig.reservedFieldPolicy: 'throw' | 'warn' | 'remap' (default 'throw').
  'throw' rejects the write naming every offending key + its correct write path;
  'warn' remaps with a one-shot per-key warning; 'remap' is the legacy silent path.
- Central enforceReservedPolicy gate wired into all four remap methods (add,
  update, relate, updateRelation) so live calls AND their transact()/with()
  mirrors honor it. Single-source reservedWritePath guidance shared by throw+warn.
- 'warn' now warns for EVERY reserved key (closes the gap where only
  system-managed fields warned). Dead warnDropped* helpers removed.
- Import pipeline migrated to route reserved values (confidence/weight/subtype)
  through dedicated params and strip reserved keys from extractor/customMetadata
  bags via the canonical split*MetadataRecord helpers — imports no longer trip
  the default throw.
- Tests: new reservedFieldPolicy matrix (throw/warn/remap across every write
  path + transact); remap-correctness suite reframed as opt-in 'remap'; shared
  test-factory no longer emits reserved keys in custom metadata.

tests/helpers/test-factory.ts

@@ -39,17 +39,21 @@ export function generateTestVector(dimension = 384): Vector {
   return vector.map(val => val / magnitude)
 }
 
-// Generate realistic metadata
+// Generate realistic CUSTOM metadata.
+//
+// NOTE: this deliberately contains only custom (consumer-owned) fields. Reserved
+// Brainy fields (`createdAt`, `updatedAt`, `confidence`, `weight`, `subtype`,
+// `visibility`, `service`, `createdBy`, `data`, `_rev`) must NOT live in the
+// metadata bag — Brainy 8.0's default `reservedFieldPolicy: 'throw'` rejects any
+// reserved key passed through `metadata`. (Reserved values belong in their
+// dedicated top-level params, set by the add/relate factories below.)
 export function generateTestMetadata(overrides: any = {}): any {
   return {
     name: `Test Item ${generateTestId()}`,
     description: 'Test description',
     tags: ['test', 'automated'],
-    createdAt: Date.now(),
-    updatedAt: Date.now(),
     version: 1,
     source: 'test-factory',
-    confidence: 0.95,
     ...overrides,
   }
 }