fix: validate environment names, and read the owner record one way

[vishr]

Two defects found by an independent review of the merged #71 — both introduced by it. Closes #54.

1. A legal config could brick the host

#71 made the environment name load-bearing: bootstrap writes it into the host owner record, and every later command parses it back through a strict grammar. Nothing validated it — environments: was the one name-bearing map in validate.go whose key was never checked against gIdent.

Measured:

"Staging"          ACCEPTED by ob validate
"prod_east"        ACCEPTED by ob validate
"staging replica"  ACCEPTED by ob validate

parseHostOwner("sample Staging")         ok=false
parseHostOwner("sample prod_east")       ok=false
parseHostOwner("sample staging replica") ok=false

ob bootstrap writes the record and succeeds. Every mutation afterwards refuses a record it cannot parse — permanently, and the message named no remedy.

Worth stating plainly: this is #54, which I filed this morning and then downgraded to low after #51, on the grounds the name no longer reached a shell or filename. That was true when written and stopped being true a few hours later, in this repository, without the issue being revisited.

2. Preflight was more permissive than the engine

hostOwnerCheck read fields[0] and fields[1] and ignored the rest; the engine rejects anything that is not exactly 1 or 2 fields. A three-field record got a green preflight and then failed every mutation — the inversion preflight exists to prevent.

There is now one parser, app.ParseHostOwnerRecord, used by both.

3. The unparseable-record refusal names a remedy

Matching the empty-record case beside it. No ob command rewrites a record it cannot read, so the operator has to be told to remove it.

Tests

Both regressions covered, both fail without the fix:

--- FAIL: TestEnvironmentNamesMustSurviveTheOwnerRecord
    environment name "Staging" was accepted by the loader but cannot
    round-trip the owner record

The existing TestHostOwnerInvalidRecordFailsClosed asserted on the word "invalid"; it now asserts the refusal names the record and its remedy, which is the property that matters.

Verified

just check, golangci-lint run ./..., go test -race ./....