fix(gstack-config): accept @local endpoint ids for brain_trust_policy

[time-attack]

Summary

• endpoint-hash returns the literal local for stdio/PGLite engines, but key validation only allowed @[a-f0-9]+, so /setup-gbrain Step 9.5 and /sync-gbrain could not persist brain_trust_policy@local.
• Widen the @ suffix to alphanumeric endpoint ids (hex hashes + local) in get/set validators and lookup.
• Add regression coverage for @local accept and punctuation reject; fix user_slug_at_local persist assertion.

Fixes #2210
Fixes #1988

Test plan

• bun test browse/test/gstack-config.test.ts
• bun test test/user-slug-fallback.test.ts
• Manual: origin/main binary rejects set brain_trust_policy@local; fixed binary persists personal
• Consumer/control clones (gbrain, zotero-arxiv-daily, actionbook, plane, twenty): Step 9.5 before/after
• plane (without-gstack) Path 3: init → MCP → gbrain put/search → policy persist with YC OpenAI key

Made with Cursor

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[time-attack]

@16francej