pub const FORBIDDEN_OBJECT_KEY: &str = "__proto__";Expand description
Forbidden object key (expression-ir.md §2.3/§8). Any path that builds an object
from IR/JSON-derived arbitrary string keys must reject an own key equal to
"__proto__" fail-closed: JS drops it (prototype setter), while Python/Rust/Go
keep it, so the same IR diverges across languages (prototype-pollution footgun).