fix(jawsboot): clean parent-relative prefixes

[linkdata]

Summary

Fixes #253.

• Roots and cleans the configured prefix before joining embedded asset names.
• Uses the same normalized prefix for hashed Bootstrap assets and source-map probe routes.
• Preserves URL serialization before ServeMux registration, keeping literal brace prefixes compatible with the jawsboot.Setup treats brace-containing prefixes as ServeMux wildcard syntax #235 behavior.
• Documents the concrete parent-relative outcome: ../static becomes /static.

Regression coverage

• Uses explicit input-to-root expectations for absolute, relative, parent-relative, and empty prefixes instead of deriving the expected root from the implementation formula.
• Calls both Jaws.Setup and jawsboot.Setup through scoped panic recovery so a registration regression fails only the affected subtest.
• Verifies every returned URL is clean, slash-rooted under the literal expected root, explicitly registered in a real http.ServeMux, and served with status 200.
• Verifies cleaned source-map routes are explicitly registered and return 404.
• Reuses the explicit-root URL expectation for literal-brace cases, retaining exact pattern and route-scope coverage.

Verification

• go generate ./...
• gofmt -l .
• go vet ./...
• staticcheck ./...
• golangci-lint run
• gosec ./...
• go build ./...
• JAWS_REQUIRE_NODE=1 go test -race -coverprofile=coverage.out ./...
• JAWS_REQUIRE_NODE=1 go test ./...
• Wrong-clean-root and injected-panic mutations both fail the intended focused regressions.