publish-issue-validation shared identity predicates

Chose shared publish-issue-validation.js repository/version/path predicates over trusting PEG title parsing independently in the controller and CI poller, because grammar acceptance is not a semantic safety boundary before authenticated API calls. Both paths must reject unsafe repository identities, non-Craft SemVer versions, and paths failing isPublishPath('.' + parsedTitle.path) before checkout, revision/check-run lookup, state creation, Craft invocation, or interpolated release-bot endpoints. Cover traversal, ., __proto__, and option-like paths; retain valid build metadata.