refactor(storage): centralize safe persisted identifier validation

[seekskyworld]

Problem

Several storage authorities independently validate persisted identity strings with the same /^[A-Za-z0-9_-]{1,128}$/ rule. The copies already differ in accepted input types, trimming, and error text, which makes a future policy change easy to apply to one authority while leaving another boundary weaker.

Scope

• Add one storage-local safe identifier predicate/asserter.
• Migrate runtime-event-invariants.ts, interaction-store.ts, session-bundle-policy.ts, session-copy-cleanup.ts, and goal-authority.ts while preserving each caller's trimming and public error contract.
• Keep provider-specific external session identifiers and the independently evolving agent-run-store / message-admission-store paths out of this change.

Acceptance criteria

• All migrated boundaries accept the same 1–128 character ASCII identifier language and reject empty, overlong, whitespace, path, and punctuation values.
• Existing error classes/messages and normalization behavior remain unchanged.
• A focused test covers the shared predicate at both length boundaries and representative invalid/non-string values.

This is a child slice of the storage consistency work identified in #1404.

[seekskyworld]

我认领这个存储切片。会新增 storage-local 的 safe identifier authority，迁移五个没有现有冲突的边界，保留各调用方的 trim、错误类型和错误文本，并用边界/非法输入测试锁定行为。