Internalizer accepts empty <key></key> violating keysym non-empty invariant guarded by _PROP_ASSERT

Summary

_prop_dictionary_internalize_body decodes <key>...</key> content into tmpkey without rejecting zero-length results. Empty key stored via prop_dictionary_set->_prop_dict_keysym_alloc creates keysym with pdk_key[0]==\0. Violates invariant documented at prop_dictionary.c:250 (they are never empty) asserted at line 252. On INVARIANTS kernels _PROP_ASSERT expands to KKASSERT which panics on production no-op so invariant violated silently. No check rejects keylen==0 in internalizer. strcpy(pdk->pdk_key "") writes lone NUL. _PROP_ASSERT(pdk->pdk_key[0]!=\0) at line 252 would fire if keysym externalized as standalone object but _prop_dictionary_externalize externalizes keys via _prop_object_externalize_append_encoded_cstring bypassing _prop_dict_keysym_externalize so common round-trip does not panic. No in-tree kernel caller invokes prop_dictionary_all_keys (grep zero callers) so panic latent. Unprivileged local user can send proplib dict with <key></key> via ioctl (DM_TABLE_LIST udev requests). Defense-in-depth/correctness issue internalizer fails to enforce invariant rest of code assumes.