refactor(storage): centralize safe persisted identifier validation #4926

Problem

Several storage authorities independently validate persisted identity strings with the same /^[A-Za-z0-9_-]{1,128}$/ rule. The copies already differ in accepted input types, trimming, and error text, which makes a future policy change easy to apply to one authority while leaving another boundary weaker.

Scope

• Add one storage-local safe identifier predicate/asserter.
• Migrate runtime-event-invariants.ts, interaction-store.ts, session-bundle-policy.ts, session-copy-cleanup.ts, and goal-authority.ts while preserving each caller's trimming and public error contract.
• Keep provider-specific external session identifiers and the independently evolving agent-run-store / message-admission-store paths out of this change.

Acceptance criteria

• All migrated boundaries accept the same 1–128 character ASCII identifier language and reject empty, overlong, whitespace, path, and punctuation values.
• Existing error classes/messages and normalization behavior remain unchanged.
• A focused test covers the shared predicate at both length boundaries and representative invalid/non-string values.

This is a child slice of the storage consistency work identified in #1404.