feat(expr): JSON-pointer sub-access on $inputs and $steps references

[emmanuelperu]

Closes #49, the last open spec-compliance issue.

What

The spec's runtime-expression examples apply #/<json-pointer> sub-access to step outputs ($steps.someStepId.outputs.pets#/0/id) and inputs; those references used to ship verbatim into generated tests. They are now translated, with every strategy validated against the real tools before implementation:

• expr: Parse accepts the pointer suffix on $inputs and $steps...outputs references (a bare # keeps whole-value semantics; #x stays unrecognised).
• Hurl, step outputs: a sub-accessed output becomes a derived capture at the producing step, the pointer folded into the source capture's jsonpath (list_body_items_0_id: jsonpath "$.items[0].id"), with collision-safe naming. This is the only strategy that works: probing hurl 8.0.1 showed that member access on a structured capture is unrenderable at run time and that placeholder filters parse but are silently ignored (the raw variable is rendered), which would have produced silently wrong requests.
• Hurl, inputs: explicitly flagged as untranslated, for the same verified reason: Hurl offers no render-time sub-access on a variable. Documented in the matrix.
• k6, step outputs: captured constants are parsed JSON, so the pointer becomes a bracket chain (list_pets["0"]["id"]; string indices address arrays in JS).
• k6, inputs: a per-reference asJson() helper parses string values on use, so an input referenced both whole and sub-accessed keeps its raw string for the whole-value use (no module-init parse, no mixed-use corruption).
• Linter: $steps output names may contain inner dots per the spec's name pattern; a dotted-name miss whose first segment IS a declared output now hints at the #/<json-pointer> form.
• The pre-scans mirror exactly what the writers serialise: post-replacement payloads, unresolved reusable parameters excluded, delegate steps skipped.

Verification

• Four empirical hurl 8.0.1 probes (member access, filters on captures, derived captures, filters on variables) drove the design; the misleading probe (a 200 from a permissive server) was caught and re-tested with rendered-output inspection.
• Scratch workflow chaining GET /products/{$steps.list.outputs.body#/items/0/id} executed against the local mock: 100% pass in Hurl; k6 script validated with k6 archive and navigates the parsed value.
• Full suite (11 packages), vet, gofmt, golangci-lint clean (2 pre-existing gosec findings in scripts/hurl-demo only); make lint dist hurl perf on all examples with byte-identical examples/generated; e2e on the mock 100% pass.
• 8-angle adversarial review; confirmed findings fixed: the silently-ignored-filter strategy scrapped (worst-failure-mode prevention), mixed whole/pointer input use, module-init JSON.parse crash, dead derived captures from dropped parameters, spec-claim accuracy in comments (ABNF vs spec examples), linter regex heuristic documented honestly.