Cover the U+FFFF encoding and detached-tree parent links

Each of the new assertions fails against the previous behavior, so they
pin the two fixes rather than merely passing alongside them:

  - the U+FFFF test, plus the U+FFFE boundary below it and a surrogate pair
    above it, so the three-byte and four-byte paths are both held in place
  - json_disconnect() leaving the parent links inside the subtree intact
    while clearing the root's
  - json_free() pruning an interior node of a tree whose parser is already
    gone, which only works because those links survive
  - json_free() of a hash value leaving the key paired with a JSON_NULL
    placeholder, which is the documented behavior and not a removal

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017KNxyHKasyWrWcvre2yK4r

CHANGELOG.md

@@ -11,6 +11,8 @@
 * Fix decoding of a `\u` escape sequence in which a high surrogate is followed
   by a non-surrogate BMP code point, which combined the two into a single
   wrong code point. (#388)
+* Fix a `\uFFFF` escape being decoded to the overlong, invalid four-byte
+  UTF-8 sequence `F0 8F BF BF` instead of `EF BF BF`. (#388)
 * Fix tile-join reading a non-string field type out of a tileset's tilejson.
   (#388)
 * Fix `tippecanoe-decode` and tile-join crashing on a directory tileset whose