Add snap.MatchJSON with dotted-path value masking

[skyrpex]

Motivation

Plain-text snapshots need regex sanitizers for volatile values; JSON output deserves structured masking instead — per-path placeholders that also assert the masked field exists.

Solution

snap.MatchJSON(t, raw, "data.currentVersion", ...) — stdlib only, no new dependencies:

• Unmarshals, replaces values at the given dotted paths with <any>, re-encodes canonically (two-space indent, sorted keys via encoding/json, HTML escaping off so the placeholder stays readable), and snapshots through the existing snap.Match machinery (same create/update/CI/cleanup semantics).
• A mask path that doesn't resolve is a hard failure, so a masked field silently disappearing is caught.
• Objects only, no array-index syntax — deliberate; add when a test needs it.
• Demonstrated on internal/output: TestEnvelopeSink_UpdateCheckedEnvelopeJSON pins the full --json envelope shape with version fields masked.

Second commit fixes a subtle test-harness bug found while writing tests: MatchJSON's fatal paths lacked return after t.Fatalf, which is invisible under a real *testing.T (Fatalf stops the goroutine) but wrote bogus snapshots under the test suite's fake TB. Regression test included.

Stacked on #443 (in-house must/snap helpers) — merge that first; this diff is only the MatchJSON commits.

Docs

Docs impact

Nothing to document externally — test-internal tooling. CLAUDE.md's Testing section is updated in this PR with MatchJSON usage.

Review

Human review advisable: same test-tooling direction decision as #443; small diff but it fixes the public helper surface other packages will adopt.

Co-Authored-By: Claude noreply@anthropic.com