fix(go): require exact metadata ownership keys

[samzong]

Summary

• require exact canonical keys when Go reads .kitup.json ownership metadata
• treat case-variant ownership fields as unmanaged so uninstall preserves user data
• add a shared golden case that enforces fail-closed behavior across SDKs

Scope Check

• Stays within the v0.1 bundled-skill installer boundary.
• Does not add marketplace, registry, remote install, script execution, GUI, MCP server, or agent runtime behavior.
• Updates golden cases for observable installer behavior changes.
• Regenerates host constants after spec/hosts.json changes. Not applicable; the host spec is unchanged.

Verification

• make check