fix(D-01): warn on non-object component config, deep-copy configs (RISK-001, RISK-002)

- Deep-copy JsonObject configs via deepCopy() before storing in the
  definition to prevent external mutation of the parsed JSON tree
- Log a warning when a component config value is not a JsonObject,
  making misconfigured JSON easier to diagnose

src/main/java/com/tiedup/remake/v2/bondage/datadriven/DataDrivenItemParser.java

@@ -279,9 +279,17 @@ public final class DataDrivenItemParser {
                     entry.getKey()
                 );
                 if (compType != null) {
-                    JsonObject config = entry.getValue().isJsonObject()
-                        ? entry.getValue().getAsJsonObject()
-                        : new JsonObject();
+                    JsonObject config;
+                    if (entry.getValue().isJsonObject()) {
+                        config = entry.getValue().getAsJsonObject().deepCopy();
+                    } else {
+                        LOGGER.warn(
+                            "[DataDrivenItemParser] Component '{}' in item '{}' has non-object config, using defaults",
+                            entry.getKey(),
+                            fileId
+                        );
+                        config = new JsonObject();
+                    }
                     componentConfigs.put(compType, config);
                 } else {
                     LOGGER.warn(