serder: strict canonical read-path parser — offset-based SAID verification, serde-free endgame

[joeldsouzax]

Goal

The read-path half of the #79 seam (design §3.3/§3.5, merged in #138): replace the tolerant serde_json deserialize path with a strict canonical parser for the five fixed event grammars.

• Returns borrowed &str fields → feeds C-a C-a · Zero-copy event input — borrow-ify KeriEvent across serder #129's borrow-ified KeriEvent<'a> directly
• Reports the d/i value byte offsets → SAID verification becomes copy-once + overwrite-slot + hash (today: 2–3 Value-tree parses plus a full re-render per event, deserialize.rs)
• Strictness is a conformance feature: rejects non-compact whitespace, duplicate keys, and out-of-spec field order by construction — input classes serde_json silently tolerates (the whitespace-acceptance bug fixed in fix(serder)!: guard version-string fixed widths and validate at every deserialize entry #139 is the proof case)

End state (design §3.5)

With #141's write path and this card, production serder is serde-free; serde/serde_json demote to dev-dependencies as the cross-backend differential oracle. Default-flip and demotion are separate breaking steps (design §6 staging).

Acceptance

• Strict parser behind the same seam vocabulary (EventLayout slots), byte-range SAID verify (no re-render)
• Differential vs the serde_json read path over the builder-reachable event space + keripy corpus
• Rejection tests: whitespace, duplicate keys, reordered fields, non-canonical escapes
• no_std + wasm green; nix flake check

Spawned by #79 (design: docs/superpowers/specs/2026-07-10-79-serialization-backend-seam-design.md). Depends on: #141. Related: #129 (C-a), #139.