feat(npm): S11 package-name & scope validation (Step 7a)

What

Split 1/3 of !427 (closed) (S11 Step 7 validation helpers), kept under the 500-LOC review line. Pure, dependency-free package-name and scope validators per docs/specs/S11-npm-local.md (Validation rules), backing the publish/dist-tag/download handlers (wired in later steps).

• ValidatePackageName — npm name rules: 1-214 bytes, lowercase, leading char, surrounding whitespace, URL-safe / encodeURIComponent, forbidden ~'!()*, reserved set; per-segment for scoped names.
• ParseScope — decompose into scope (@ sigil retained) and plain name; validates via ValidatePackageName first.
• PackageNameError + PackageNameInvalidReason carry the rejection cause for the package_name_invalid envelope detail.

Spec / acceptance

Covers AC 39 (package_name_invalid) unit half. Table-driven units with

=1 positive + negative case per rule, plus multi-rule rejection cases and FuzzValidatePackageName (no-panic over arbitrary input + a ParseScope/ValidatePackageName validity-agreement invariant).

Notes

• Stacking: base of the 3-MR stack; targets main. !427 (closed) superseded.
• validate.go uses a detached file comment (the package doc now lives in buffered.go, merged via npm Step 24 since !427 (closed) opened) to avoid a second package godoc — clears the godoclint failure !427 (closed) hit after main advanced.
• Review follow-ups: //nolint:gochecknoglobals on reservedNames (otherwise blocks the merged-results golangci-lint); added FuzzValidatePackageName + a positive test; documented that reserved names are a full-name (top-level-only) check matching npm's validate-npm-package-name. The reserved-set scoping and the isURLSafeSegment uppercase arm are discussed in-thread.
• CI: the red conformance:oci and lint:links jobs are both allow_failure and pre-existing/base-wide — lint:links is gitlab.com 429 rate-limiting; conformance:oci fails identically on unrelated MRs (e.g. !437 (merged)) and does not run on main. Neither is touched by this npm-only change.