[TASK] Input validation grammars (S14)

[kirich1409]

Context

Strict regex for --session, --since, --module, --allow-danger. Invalid input → exit 2.

Acceptance criteria

• --session matches ^\d{4}-\d{2}-\d{2}-\d{6}-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$.
• --since matches ^\d{1,4}(d|w|m|y)$|^\d{4}-\d{2}-\d{2}$; max 10 years.
• --module matches ^[a-z0-9]+(\.[a-z0-9-]+)*$; unknown module rejected.
• --allow-danger=<id> whitelist of ids.

Files to touch (estimate)

best-effort estimate; agent refines during implementation

Implementation notes

n/a

Dependencies

None.

Safety checklist

See .github/ISSUE_TEMPLATE/task.yml — tick applicable invariants in the issue if any destructive path is touched.

Definition of Done

• Acceptance criteria satisfied and verifiable
• Tests added or updated
• No build / lint / test regressions
• Self-review against research-report invariants
• Code review approved