sec (1/9): restrict user-defined scanner IDs to lowercase

[jesse-merhi]

What changes

A user-defined scanner ID from profile/config must now be lowercase
(^[a-z0-9][a-z0-9_-]*$) and at most 64 characters. Mixed-case or oversized
IDs are rejected at config-resolution time, before any scanner runs.

Why it matters

Scanner IDs are used as map keys and as path/registry segments. Two IDs that
differ only by case (Foo vs foo) can collide when case-folded, letting one
config entry silently shadow another entry or a built-in scanner such as
clawscan-static. A single canonical spelling removes that ambiguity; the
length cap stops an ID from being an unbounded string.

Before / after (runnable)

up.yml:

version: 1
profiles:
  demo:
    scanners:
      - id: Foo
        command: "scan {{target}}"

	Behavior
Before	Foo accepted; can resolve alongside foo — collision possible
After	run aborts before scanning:

$ clawscan ./skill --config up.yml --profile demo --sandbox off --json
User-defined scanner Foo in profile demo has invalid id; use lowercase letters,
digits, underscores, and hyphens, starting with a letter or digit

Verify

go test ./internal/profiles/ -run 'UserDefinedScannerID' -count=1

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: sec (1/9): restrict user-defined scanner IDs to lowercase This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.