Inventory bounded observed key and type paths from one unauthenticated public JSON API response, with status and SHA-256 evidence but no raw values.