Anchor jq validators at true string ends so malformed keys fail closed

[thetangstr]

Summary

• Fixes an independent-review finding on PR Deploy wrapper: drop node dependency so the systemd unit can restart #116's node-free validator: jq's test() uses Oniguruma, where $ anchors before a trailing newline, and $(...) strips trailing newlines — so a kid or secretBase64 with an escaped trailing \n could pass the wrapper while the container's stricter JS validator rejects it, deferring failure to container startup.
• All security-relevant patterns now anchor with \A...\z (true string ends), in both the runtime-key filter and the release-pin filter.
• Canonicality is not claimed by the regex: secretBase64 gets a strict structural pattern (alphabet + padding shape), which also guarantees the extracted value contains no whitespace for $(...) to strip — making the original base64 -d | base64 decode-and-reencode equality check safe to run again. Nonzero pad bits (e.g. ...ZWV=) still fail exactly as the old node validator rejected them.
• New regression fixtures prove all three malformed variants are rejected before docker is invoked: escaped trailing newline in kid, escaped trailing newline in secretBase64, a noncanonical pad-bit variant at valid apparent length, and a trailing-newline sourceCommit in the release pin (the release_filter got the same \\A\\z hardening).

Test plan

• node --test infra/test/deploy-assets.test.mjs — 29/29, including all new rejection cases (asserted: nonzero exit, docker never invoked)
• Root npm test — 625 workspace + 36 infra, 0 fail
• npm run build, git diff --check clean
• CI build-test (20), (22)

Generated with Devin