fix: preserve explicit CLI identities safely

[codeforester]

Summary

• preserve explicitly supplied application names in Click, context, and diagnostics
• reject empty identities and derive path-safe hashed runtime components for unsafe names
• keep readable namespaces while preventing punctuation, path, and case collisions
• document the migration boundary and add identity/runtime regression coverage

Closes #267

Validation

• focused path, registration, runtime, profile, and config tests
• strict mypy and Ruff
• changelog validator