fix(cli): reject invalid derived app ids before scaffolding

[be-student]

What

• Reject pn init when the generated com.example.<segment> app ID violates the existing configuration validator.
• Apply the same check to explicit names and the no-name current-directory path before any file is written.
• Keep --force from bypassing validation and document the behavior.

Why

Names such as class, cla-ss, and current directories such as Class all derive the reserved Java package segment class. The scaffold previously succeeded, but later configuration loading rejected the generated project.

How

init_project() now derives the app ID once, validates it with the configuration's existing app-ID validator before inspecting or mutating the target, and reuses that exact value when rendering the configuration. Errors identify the source name, generated ID, and a valid next command.

Regression coverage includes all 53 configured Java keywords, normalization collisions, explicit and no-name initialization, new/empty/existing targets, --force, and valid substring names whose generated configurations load on both platform app-ID commands.

Testing

• ./scripts/check.sh: passed on exact head f5744c34323d0ac2ab9297546757ffab786da0cf (Ruff, Black over 314 files, MyPy over 205 source files, package builds, full pytest, and E2E coverage).
• Full pytest: 1,509 passed, 14 skipped.
• Focused CLI/config suite: 229 passed.
• Independent context-free review: 424 adversarial keyword, normalization, no-name, force, mutation-prevention, and valid-suggestion cases passed.
• Normal documentation build: passed. Strict local documentation validation remains blocked by 78 existing libcairo warnings unrelated to this change.

Risks / Impact

The change rejects only projects whose generated app ID would already fail when loaded. Valid name derivation remains unchanged. Validation evidence is from macOS; hosted Linux and Windows CI remain authoritative.

Docs / Follow-ups

The getting-started and CLI documentation now describe rejection of generated Java reserved package segments.

Implemented and tested with AI assistance, followed by an independent context-free review. No human manual or device testing is claimed.

Closes #78

[be-student]

Exact-head local terminal evidence for f5744c3: uv run pytest tests/test_cli.py tests/project/test_config.py -q -o addopts='' passed all 229 focused CLI/config tests on macOS with Python 3.14. A separate exact-head Sol review also ran the full ./scripts/check.sh, documentation build, and adversarial CLI probes with no findings. Hosted CI is still awaiting repository authorization; no native-device run is claimed.