CVE-2026-71866: Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

orval’s zod client emits each schema property name as a double-quoted key in the generated zod.object({…}) WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({…}) runs – which is at MODULE IMPORT (the export const X = zod.object({...}) executes on load) -> import-time RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116.