fix: escape report machine-status JSON

[randlee]

Summary

• render dynamic machine-status JSON values with MiniJinja's tojson filter
• preserve native JSON types instead of forcing every value through a quoted string
• add adversarial round-trip coverage for quotes, backslashes, newlines, markup-like text, numbers, and nested finding counts

Why this is a separate stack layer

This is the second independently reviewable harmonization change after #184. It changes only JSON serialization in the two report templates and the focused regression test. Report schema alignment (for example, blocking_ids/deliverable contract differences) is intentionally out of scope.

The change follows the sc-compose/MiniJinja boundary: structured values are serialized with the formatter's JSON encoder instead of hand-quoting template substitutions. That produces valid fenced JSON without HTML entity workarounds or permissive rendering flags.

Validation

• fresh Luna validation against adversarial values
• focused TemplateContractTests.test_quality_report_machine_json_round_trips_strings
• just lint
• just test
• git diff --check

Stack

• depends on fix: render carry-forward findings as arrays #184 (codex/render-json-list-vars)