fix(miner): reject path-traversal repo segments in the 4 remaining normalizeRepoFullName parsers

[davion-knight]

Problem

repo-clone.ts's isValidRepoSegment rejects a ./../control-char owner or repo segment before it's persisted to SQLite or echoed through a CLI. #5831 and #7525 rolled it out to ten sibling parsers, but four were missed and still only check "exactly one slash, both halves non-empty":

• contribution-profile-cache.ts, prediction-ledger.ts, replay-snapshot.ts, run-state.ts

Inputs like "owner/..", "../repo", and segments with tab/newline pass these four but are correctly rejected by the already-fixed siblings — and each backs a SQLite key (*.sqlite3) and is echoed through its sibling CLI, exactly the rationale #5831/#7525 used.

Fix

Import and call isValidRepoSegment(owner)/isValidRepoSegment(repo) in all four normalizeRepoFullName functions, matching the exact call shape of the ten already-fixed siblings (claim-ledger.ts, governor-state.ts, …) — no new validation approach.

Tests

A per-file regression test drives each module's own store method (get/put, appendPrediction/readPredictions, getSnapshot, getRunState/setRunState) with "../etc" (owner-invalid) and "o/.." (repo-invalid) — covering both operands of the new || branch — plus invalid-character cases, asserting .toThrow("invalid_repo_full_name"), mirroring test/unit/miner-claim-ledger.test.ts's existing assertion. 84 tests pass across the 4 files.

Verification

Each file's new guard + import lines are covered (guard-line hits 30/25/83/47); the only uncovered lines in the report are pre-existing, unrelated to this diff. Root typecheck clean. The compiled .js are gitignored, so the diff is the 4 .ts sources + 4 test files.

Closes #7795

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[davion-knight]

Superseded — rebasing onto current main to resolve a base overlap; a clean PR will follow.