fix: emit one separator style in --json path fields on Windows

[DLANSAMA]

Problem

A Windows --json envelope mixed separator styles. The typed local path fields (file, path, output, workdir, the job step paths, …) came out with \, while human-facing messages, remote printer paths, and archive entries in the same document used /. A consumer could not compare or join two path fields without knowing which side produced each one.

Reproduced on main before changing anything:

"file":   "~\repos\platecli\tests\fixtures\cube.stl"   ->  "~/repos/platecli/tests/fixtures/cube.stl"
"output": "D:\elsewhere\cube_sliced.3mf"                  ->  "D:/elsewhere/cube_sliced.3mf"

Approach

utils._json_display_paths already funnels every declared path key through one hook, so this is a one-place fix rather than a per-call-site sweep:

• Add paths.json_path() — separator normalization only — applied after the existing ~ compaction.
• Add local_path to _JSON_PATH_KEYS. It was the one declared local-path contract field not covered (currently dormant, but reachable via JobOk).

URL-valued path fields keep their own separators and their redaction. Remote printer paths and archive entries are untouched. No behaviour change on macOS/Linux, where os.sep is already /.

~ compaction is deliberately kept

An earlier plan for this fix called for dropping the tilde-shortening so agents get directly openable paths. That would have leaked the username into every envelope: ~ compaction in JSON is a documented privacy guarantee (AGENTS.md, docs/api.md:55) that tests/privacy_smoke.py actively enforces by scanning output for $USERNAME and /Users/<name>. ~ also stays openable — paths.expand_path reverses it, and it is the form the CLI already accepts. This PR fixes the separator inconsistency only.

Verification (Windows, Python 3.11)

• Full suite at CI hardness (-W error::ResourceWarning, --cov-fail-under=86): 1497 passed, 5 skipped, 1 deselected (live). Was 1494 on main; +3 new regression tests.
• Coverage 90.56%.
• ruff@0.16.0 check and format --check: pass (94 files).
• bandit@1.9.4 -ll: 0 medium, 0 high.
• All 8 CI smoke scripts pass, including privacy_smoke.py.
• scripts/gen_schemas.py produces no diff — no schema drift.

The new tests in tests/test_jsonio.py monkeypatch os.sep, so they pin the Windows contract on any host rather than passing vacuously on Linux CI.