feat(identifiers): add allowed device list and organization tag to run IDs

Lets new_run_id() take an allowed_devices mapping (device ID to organization), gated by identifiers.allowed_devices_mode ("optional"/ "required"), with a sanity check against prior runs' recorded organizations. Downstream consumers (e.g. register_calibration_graph()) can validate a device ID against the active run via validate_device_id().

Closes #402