fix(contract): validate role names for stable machine output

[saraeloop]

Summary

Harden the role-name contract so gitrole’s machine-readable output remains stable and predictable.

Changed

• centralize role-name validation in src/domain/role.ts
• require role names to match ^[a-z0-9_-]+$
• add InvalidRoleNameError with clear error messages
• enforce validation for:
  • gitrole add
  • gitrole import current --name <role>
  • direct role-referencing commands such as pin and remote set
• validate names during role normalization so invalid persisted data fails clearly instead of leaking broken tokens into status --short
• add focused tests for:
  • valid names like work, client-acme, and agent_bot
  • invalid names
  • consistent CLI errors
  • exact status --short output for valid role names
  • bad persisted role-name handling

Verification

• npm run build
• npm test
• npm run test:e2e
• npm run test:release

Notes

• no docs changes in this pass
• this is contract hardening to keep machine-readable output honest and stable