Function derive_properties 

pub fn derive_properties(attrs_json: &str) -> NodeProperties

Derive NodeProperties from a JSON-serialized attrs string.

Detection precedence (DP-1, DP-3, DP-5):

1. STATUS key present → Actor (DP-5: a STATUS-bearing payload always decodes as Actor, so the actor-attrs seam cannot spoof node kind)
2. node_type = “root” / “host” / “proc” → corresponding variant
3. error_code present → Error
4. none of the above → Error(“unknown_node_type”)

DP-2 / DP-4: this function is total — malformed attrs never panic; view decode failures map to NodeProperties::Error with a malformed_* code. AV-3 / IA-6: view decoders ignore unknown keys.