fix(asap): avoid double-free on malformed JSON-RPC results

[cursor]

Summary

HIGH heap use-after-free / double-free on the ASAP client JSON-RPC response path — distinct from inbound-server PRs #53/#60/#61/#64.

asap_envelope_from_object / parse_fail (src/asap/envelope.c:104) already cJSON_Deletes the duplicated JSON-RPC id when a result envelope is missing required fields. asap_envelope_parse_jsonrpc_response then deleted the same pointer again (src/asap/envelope.c:331 on a057f0e).

Concrete trigger

asap_invoke / asap_client_send_task receives HTTP 200 with a JSON-RPC result object that lacks payload (or another required string), e.g. a hostile registry base_url or malicious remote agent:

{"jsonrpc":"2.0","id":"1","result":{"id":"t1","asap_version":"2.1","sender":"a","recipient":"b","payload_type":"task.response"}}

Inbound asap_envelope_parse does not double-free (it leaves rpc_id to parse_fail). Existing tests only covered a valid result and a top-level JSON-RPC error object.

Impact

Heap use-after-free → process crash; possible allocator corruption on the agent daemon.

ASan confirmed: cJSON_Delete in parse_jsonrpc_response after parse_fail via from_object (missing payload).

Fix

Do not cJSON_Delete(rpc_id) on the from_object-failure path (match inbound parse). Document that rpc_id is consumed on validation failure.

Test plan

• test_parse_response_missing_payload — unit parse of HTTP 200 result without payload
• test_live_http_malformed_result_envelope — asap_client_send_task against a 200 with the same body
• Full test_asap_client under AddressSanitizer