Address review notes in jsonpull itself

- json_stringify walked c_str(), so it truncated at an embedded NUL even
  though values are std::string now and carry one through faithfully.
  Range over the string instead; the existing control-character branch
  already escapes a NUL like any other, so the output stays valid JSON.
- Assert that the hash has an entry waiting before add_object() assigns to
  entries().back(). It always does -- JSON_VALUE is only set by a colon,
  which requires a pushed key -- but the derivation is not local.
- Drop fabricate_object(), a pass-through to make_object() with the
  arguments reordered, kept only to preserve the old C name.
- Inline the string_append / string_append_c wrappers over push_back and
  append, and note that json_print_one's JSON_HASH and JSON_ARRAY branches
  are unreachable, since json_print handles both itself.
- json_hash_get's comment said nullptr meant "the matching value is null",
  which reads as JSON null. A JSON null comes back as a JSON_NULL node;
  nullptr means the value slot is not filled in yet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017KNxyHKasyWrWcvre2yK4r

jsonpull/jsonpull.h

@@ -394,8 +394,10 @@ json_object_ptr json_disconnect(json_object *o);
 
 // Look up `s` in the hash `o`. Returns a borrowed pointer; ownership
 // stays with the hash. nullptr if `o` is not a hash, or `s` is absent,
-// or the matching value is null. Accepts a json_object_ptr by reference
-// as a convenience so callers don't have to write `.get()`.
+// or the hash is still being parsed and the value slot for `s` is not
+// yet filled. A JSON `null` value is *not* one of those cases: it comes
+// back as a JSON_NULL node. Accepts a json_object_ptr by reference as a
+// convenience so callers don't have to write `.get()`.
 json_object *json_hash_get(const json_object_ptr &o, const char *s);
 json_object *json_hash_get(json_object *o, const char *s);