fix(epcis): keep captured events queryable across JSON-LD type mappings

[branarakic]

EPCIS captures now preserve accepted standard and absolute extension event types even when the caller's JSON-LD context maps type to an ordinary property. Capture records one declared EPCIS type, and queries use it to avoid duplicate or misclassified events from auxiliary RDF classes. Public and private branches render the same explicit query body; offsets over 10000 fail with the typed input error. Unfiltered queries include declared external types; unmarked legacy RDF retains its namespace behavior.

The publication boundary expands caller JSON-LD and rejects reserved declarations, including nested same-subject nodes, aliases and reverse edges. It checks for conflicting declarations within and across public/private content, then publishes the inspected expansion. Remote contexts are reused during inspection and normalization, and publication receives no contexts to re-fetch. Input documents remain unchanged and auxiliary RDF classes remain intact. jsonld is now a runtime dependency; AsyncPublisher receives expanded JSON-LD in the existing visibility slots.

The bundled GS1 schema remains unchanged. Capture uses a strict domain resolver; historical compact extension names are accepted only by the query adapter. Standard responses stay compact and extension responses preserve their full IRIs.

Validation:

• 229 offline EPCIS tests pass with coverage thresholds (97.82% statements, 93.95% branches); 86 pre-existing opt-in API E2E tests remain skipped.
• All 32 live capture/query cases pass across Oxigraph and upstream Blazegraph 2.1.5. Six new regressions fail the preceding head: external-type omission and forged declarations in both visibility slots.
• Four real CLI/agent publication cases pass across bare, public, private and dual visibility. All 19 daemon route-readiness cases pass, with strict fixture types including that route harness.
• EPCIS build, lint, 1795-file inventory and SPARQL checks pass. The owned Hardhat and Blazegraph processes were stopped.
• Candidate CI wiring adds the required live EPCIS suite to the Blazegraph job and routes EPCIS edits there; 25 planner/policy tests pass. The protected controller pin remains unchanged. Activating the new routing for later EPCIS-only edits still requires the reviewed controller policy to land and its trusted pin to be rotated.

Closes #707.

[branarakic]

CI found that the new storage-backed suite depended on a workspace link left in my reused checkout. Commit 411d77e declares @origintrail-official/dkg-storage as an EPCIS test dependency and updates the lockfile. A frozen install, the full EPCIS dependency build closure, and all eight external-event storage cases pass locally. The new commit is now running in CI.