Add safe configuration report helpers

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Implement ConfigKit adoption and configuration comparison
 
-Status: implementation in progress; Stages 1–5 are complete.
+Status: implementation in progress; Stages 1–6 are complete.
 
 ## Scope and authority
 
@@ -308,12 +308,15 @@ at semantic mapping paths. This stage does not classify records or deliver outpu
    effects. They do not examine original configs, expand atomic regions, infer
    masking from strings, or determine whether a difference exists.
 
-**Completion evidence:** focused helper tests for root and `/`, nested placement
-sharing an ancestor, numeric/dot/percent keys, and escaped slash/tilde keys.
-Include `~01` decoding to literal `~1`, without decoding twice. Test value tags
-for null, booleans, large integers, strings resembling numbers/booleans, and empty
-containers. Test malformed snapshot YAML returning an error. Stage 7 owns report
-classification and disclosure cases; do not duplicate its complete report suite.
+**Completion evidence — complete:** private YAML-node helpers now decode safe
+snapshots without converting them through loosely typed values, decode canonical
+JSON Pointer tokens once, and insert mapping keys as YAML strings while reusing
+ordered ancestors. Focused checks cover root and `/`, nested placement sharing an
+ancestor, numeric/dot/percent keys, escaped slash/tilde keys, and `~01` becoming
+literal `~1`. Snapshot tags are checked for null, booleans, a large integer,
+number/boolean-like strings, and empty mappings/sequences; malformed YAML returns
+an error. `go test -count=1 ./...` passes in ckconfig. Classification and report
+disclosure remain for the following stage.
 
 ## Stage 7: Classify native records and encode the YAML document