`matches` had every test; the six utilities this package also exports had
none. That left the pointer behaviour inherited from the dependency
unpinned, so a bump could have changed any of it silently.

Covers the RFC 6901 rules that are easy to get wrong: `-` names the
element after the last one and must not resolve on a read, `~1` decodes
before `~0`, and an array index may not carry a leading zero.

Also pins two deliberate departures, so they read as decisions rather
than drift. `/` means the whole document here rather than the value
under the empty-string key. And `fromJsonPointerMap` infers a container
from the next token's shape, which is what lets a caller compile "any
array index" to the literal token `0` and get an array back.

Every assertion is mutation-verified. Three drafts of these tests could
not fail and were rewritten: the missing-segment fixture needed a value
at the root for a re-rooting resolver to find, the empty-container tests
read presence rather than emptiness, and the `assert` case never called
the four-argument form it was named for.

Five defects. Two are reachable from a pointer map an outside party
authors, which in a query flow means whoever wrote the query:

`matches` did not check that `map` was a `Map`, and `_isWildcard` tested
a bare `size`. Anything carrying `size: 0` -- a `''`, or a `{"size": 0}`
parsed out of JSON -- turned every constraint into "match anything", so
a selection predicate answered `true` for every candidate. It now
asserts the type and tests the wildcard by class.

`resolvePointer` gated each hop on `in`, which walks the prototype
chain: `/toString` and `/constructor` resolved on every plain object,
and a wildcard entry naming one matched a document that has no such
field. It now walks the tokens itself against own properties and refuses
`__proto__`, `constructor` and `prototype` outright.

The other three are correctness:

`fromJsonPointerMap` assigned through `__proto__` as a final token,
replacing the prototype of the object it was rebuilding -- the result
stringified as `{}` while its properties still read back. The same three
tokens are now refused on the write path.

`toJsonPointerMap` returned the walk cursor instead of the map, so three
inputs its own `assert` allowed came back as `undefined`, `null` or a
`Set`, and the caller's next `.get` failed somewhere else entirely.

`fromJsonPointerMap` returned from inside its loop on a root pointer,
silently discarding every other entry in either key order.

`assert` also now enforces presence when `optional` is false. Without
that the first two fixes are decorative, since `undefined` passed every
check.

All three empty forms already mean "any value at this pointer". This
records which to reach for: an empty `Map`, which is what `{}` in an
example becomes, and what JSON-LD Framing already uses.

The empty string keeps working. It is the written QueryByExample
convention, and a conversion elsewhere special-cases it. But it is a
value standing in for a wildcard: type-specific, it reads as "the name
is blank", and it makes "this property is the empty string"
inexpressible. A test now pins that ambiguity so it is a known cost
rather than a surprise.

No behaviour change.

Runs eslint, node tests across 22/24/26, browser tests, and a coverage
report uploaded to Codecov. Bumps eslint-config to ^9 and eslint to ^10
to match, and adds the v8 coverage provider; coverage is configured at
the vitest root because it is process-wide and cannot be set per project.