detailsFromContext repo version validation

Trap: validating only the parsed publish path looks sufficient because the PEG grammar limits repository and version characters, but option-like/prototype repository names can reach checkout and non-SemVer versions can reach state creation and craft publish. Fix: fail closed in detailsFromContext() before workflow side effects: reject unsafe repository identities and require Craft-compatible isValidVersion SemVer validation. Preserve valid build metadata such as 4.2.6+sentry1; grammar parse failure alone is not a field-specific safety boundary.