coding_package summary null crash

Trap: coding_package.get("summary", {}).get("documents_sha256") looks null-safe because it supplies {} as a default, but the default applies only when the key is absent; summary: null raises AttributeError in both full and fragment validators after schema errors are collected. Fix: require summary to be a mapping before dereferencing it, return a deterministic validation error, and regress both entry points with summary=None.