test(packaging): cover native manifest parse refusals

[harshitethic]

Summary

Add focused regression coverage for the four native-overlay manifest refusals tracked in #408:

• invalid JSON;
• artifacts with a non-array shape;
• valid but non-canonical JSON serialization;
• duplicate JSON fields.

Each case builds a real one-module Cython overlay, mutates only hflow-native-overlay.json, calls the public apply_cython_overlay path, pins the exact refusal, and verifies the source remains in place with no native artifact or installed manifest published.

The canonical-JSON case keeps the parsed payload semantically identical and changes serialization only. The duplicate-field case edits raw bytes because a Python mapping cannot represent duplicate keys.

No production behavior or error text is changed.

Closes #408.

Validation

The new tests use the same real-overlay path as the existing packaging refusal coverage and therefore require the repository's documented system C compiler. GitHub Actions is the authoritative full-suite validation for this branch.

AI assistance disclosure: AI assistance was used to inspect the issue and existing test patterns, prepare the focused tests, and review the resulting change.

[github-actions]

👋 Hi @harshitethic — thanks for the contribution! To keep starter issues available
for other contributors and give every pull request a real review, we accept
1 open pull request per contributor at a time.

You already have #415 open, so this one is being closed automatically.
Once your open pull request is merged or closed, feel free to reopen this one —
no work is lost.