fix: validate sandbox names to prevent shell injection

[futhgar]

Summary

Sandbox and instance names from user input are interpolated directly into shell commands (openshell sandbox connect ${name}, docker run --name ${name}, etc.) without validation. A name containing shell metacharacters (;, $(), backticks, pipes) could execute arbitrary commands on the host.

Note: This addresses the same issue as #45 but differs in error handling approach and includes unit tests. Key differences:

• validateName() throws an Error instead of calling process.exit(1), allowing callers to handle validation failures contextually
• CLI dispatch catches the error silently and falls through to the "Unknown command" handler, preserving existing UX for typos like nemoclaw boguscmd
• Includes 7 unit tests (test/runner.test.js)

Fix

Add validateName() to runner.js enforcing ^[a-zA-Z0-9][a-zA-Z0-9._-]{0,62}$ and call it at the three user-input entry points:

• CLI sandbox dispatch — nemoclaw <name> <action> (nemoclaw.js)
• deploy command — nemoclaw deploy <instance-name> (nemoclaw.js)
• onboard wizard — sandbox name prompt (onboard.js)

Changes

File	Change
bin/lib/runner.js	Add validateName() with regex enforcement and export it
bin/nemoclaw.js	Import validateName, call it in deploy() and sandbox dispatch
bin/lib/onboard.js	Import validateName, call it after sandbox name prompt
test/runner.test.js	7 unit tests covering valid names, length limits, empty input, metacharacter rejection

Test plan

• npm test — 45/45 pass (38 existing + 7 new)
• nemoclaw my-assistant connect — valid name, passes validation
• nemoclaw "test; echo pwned" connect — rejected with clear error
• nemoclaw deploy '$(whoami)' — rejected
• nemoclaw onboard with empty name → defaults to my-assistant (valid)
• nemoclaw boguscmd — still shows "Unknown command" (not "Invalid name")

Fixes #45

[futhgar]

Closing — this overlaps with #170 which was merged and addresses the same sandbox name validation issue. Thanks!