app create silently drops emoji and symbols from a derived blockId

[ZacxDev]

Split out of the #267 audit as a product decision, not a bug fix — the current behaviour is deliberate and #267 leaves it unchanged.

Behaviour

$ civitai app create "Rocket 🚀 App" --dir ./r -y
$ grep blockId ./r/block.manifest.json
"blockId": "rocket-app"

Same for ∑, №, °. The emoji folds to a hyphen, which then collapses, so it vanishes without a word.

Why it is currently allowed

#267 refuses a name whose non-ASCII letters, digits or marks would be lost ("ÜberApp Ω" now exits 2 rather than minting berapp), but routes non-ASCII IsSpace || IsPunct || IsSymbol to the same separator treatment ASCII punctuation already gets. Measured census: 8,580 printable non-ASCII runes take the separator branch, 140,323 the refuse branch.

The rationale — that these characters "carry no content of their own" — is sound for ©, «» and the em dash, and it is consistent with how ASCII & and + are treated. It is weaker for emoji, which are content, and which are plausibly the most common non-ASCII character in a 2026 app name.

The decision

Narrowing the separator branch to Zs|Pd|Pi|Pf|Po would make "Rocket 🚀 App" exit 2 and demand --slug. That is a wider break than the one #267 already ships, on names that work today, so it wants a deliberate call rather than being folded into an audit fix round.

Options:

1. Leave as-is, documented as a deliberate exception (what fix(scaffold): refuse to mangle a non-ASCII name into a blockId, add --slug, and echo the derived id #267 does now).
2. Refuse, consistent with the letter/digit/mark rule — the author picks the slug for a name we cannot faithfully derive.
3. Strip emoji specifically but keep other symbols as separators — arguably the least principled, since it needs its own category list.

blockId is the permanent public identity (https://<blockId>.civit.ai/) and is effectively unrenameable after submit, which is the argument for (2). The argument for (1) is that rocket-app is a perfectly good slug and refusing it is friction for no gain.

Related: #259, #267. The other two silent-loss classes found in the same audit (invalid UTF-8, and the two Unicode runes that lower to ASCII) are being handled in #267's fix round.