farm assertSafeRunId admits Windows reserved device names as run ids

[SUaDtL]

[NEEDS-TRIAGE] raised by the auth-crypto-reviewer during the #430 merge gate; out of scope for that pass, flagged rather than acted on.

assertSafeRunId (plugins/ca/tools/farm.ts:1015-1022) validates a run id as a safe single path segment — rejecting traversal, separators, ./.., empty and oversized — but admits Windows reserved device names: NUL, CON, AUX, PRN, COM1-COM9, LPT1-LPT9.

Since #430 the run id is both an ownership boundary and a directory name under .farm/runs/<runId>/. On Windows, mkdir against a reserved name behaves unpredictably, and mkdir(runDir) at farm.ts:1963 sits outside the try/finally — so the failure mode is an unhandled throw before the cleanup scope is established.

This is a reliability / evidence-loss concern, not a secrets one: the run's receipts are the recovery record, and a run that cannot create its artifact directory loses them.

Reachable via the FARM_RUN_ID env var that #397 introduced to let an orchestrator pin the id.

Acceptance criteria

• AC-1: FARM_RUN_ID=NUL (and a representative COM1) is refused by assertSafeRunId at startup with the same bounded diagnostic as the other rejections.
• AC-2: the check is case-insensitive and covers the NUL.txt extension form, which Windows also treats as reserved.
• AC-3: a test pins both, and confirms an ordinary run id is still accepted.