fix: close explicitly open composition branches in strict mode

[FanouZeng-TT]

Description

Strict mode uses unevaluatedProperties: false on composition parents so
properties declared across allOf branches can coexist. A direct branch that
explicitly keeps additionalProperties: true defeats that closure:

{
  "allOf": [
    {
      "type": "object",
      "properties": { "id": { "type": "string" } },
      "additionalProperties": true
    }
  ]
}

The branch marks every unknown property as evaluated, leaving nothing for the
parent's unevaluatedProperties: false to reject. This lets fields removed by
UCP operation annotations back into strict validation, as reported in #69.

Fix: remove an explicit additionalProperties: true from direct composition
branches in strict mode. Branches without the keyword remain untouched, so
properties declared by sibling branches still compose normally. The regression
asserts that a valid cross-branch payload passes while an extra unknown property
is rejected.

Category (Required)

• Core Protocol: Changes to the UCP protocol itself. (Requires Technical Council approval)
• Governance/Contributing: Changes to governance or contribution processes. (Requires Governance Council approval)
• Capability: Changes to an existing UCP capability. (Requires Maintainer approval)
• Documentation: Documentation-only changes. (Requires Maintainer approval)
• Infrastructure: Changes to CI/CD or infrastructure. (Requires DevOps Maintainer approval)
• Maintenance: Dependency updates or routine maintenance. (Requires DevOps Maintainer approval)
• SDK: Language-specific SDK updates and releases. (Requires DevOps Maintainer approval)
• Samples / Conformance: Maintaining samples and the conformance suite. (Requires Maintainer approval)
• UCP Schema: Changes to the ucp-schema tool. (Requires Maintainer approval)
• Community Health (.github): Changes to shared GitHub configuration. (Requires DevOps Maintainer approval)

Related Issues

Fixes #69

Checklist

• I have followed the Contributing Guide and Code of Conduct.
• I have updated the documentation (if applicable).
• My changes pass all local linting and formatting checks.
• I have added tests that prove my fix is effective.
• New and existing unit tests pass locally with my changes.
• (For Core/Capability) I have included/updated the relevant JSON schemas.
• I have regenerated Python Pydantic models by running generate_models.sh under python_sdk (not applicable).

Screenshots / Logs (if applicable)

• cargo test — 158 unit, 81 CLI, 27 conformance, 19 container, 69 resolver, and 1 doc test passed
• cargo clippy --all-targets --all-features -- -D warnings — passed
• cargo fmt --all -- --check — passed
• uvx pre-commit run --all-files — all 11 hooks passed
• CLI regression — valid cross-branch payload accepted; payload with an unknown property rejected
• git diff --check — passed

🤖 Generated with Claude Code