fix(core): walk path helpers through a null parent

Problem

setByPath, addByPath and removeByPath decide whether an intermediate value can be walked into with typeof current[segment] !== "object". typeof null is "object", so when a streamed patch leaves a null member on the path — {"type":"Section","props":{},"children":null} is what a model actually emits — the walk keeps null as the next container and the following property access throws:

compileSpecStream([
  '{"op":"add","path":"/elements/main","value":{"type":"Section","props":{},"children":null}}',
  '{"op":"add","path":"/elements/main/children/0","value":"a"}',
].join("\n"));
// TypeError: Cannot set properties of null (setting '0')

replace and remove failed the same way when a parent on the path is null.

Change

New isContainer() guard (typeof value === "object" && value !== null) replaces the six typeof ... !== "object" checks:

• add / set now treat a null member like a missing one and replace it with the container the next segment needs — the same thing they already did for undefined.
• remove treats a null parent as a missing path, so it is a no-op instead of a TypeError.

Tests

Four cases in packages/core/src/types.test.ts: add through a null child, replace through a null parent, remove through a null parent, and the exact compileSpecStream reproduction from the report.

pnpm exec vitest run packages/core/src/types.test.ts
# Tests  128 passed (128)

Red check with types.ts reverted, running only the new block:

× add creates the container the next segment needs      TypeError: Cannot set properties of null (setting '0')
× replace writes through a null parent                  TypeError: Cannot set properties of null (setting 'name')
× remove leaves a null parent alone instead of throwing
× compileSpecStream applies a patch through a null parent
# 4 failed | 124 skipped

tsc -p packages/core/tsconfig.check.json and prettier --check both pass.

Fixes #433