fix(#2391): reject ".." in credential/snapshot names (path-traversal hardening)

Per mara's review: validate_credential_name allowed any [A-Za-z0-9_.-]
byte sequence, which permits a literal ".." substring. Not currently
exploitable (snapshot_path() embeds the label inside a single
format!()'d path component with no "/" in the allowed charset, so
there's no directory to traverse into), but it's a landmine for any
future caller that builds a path via PathBuf::from(name) directly
instead of the current string-embedding. Reject ".." outright in the
shared validator, plus a matching client-side check in hivectl for
fail-fast UX (hive-priv's copy is still the authoritative one).

hive-c0re/src/bin/hivectl.rs

@@ -1751,6 +1751,9 @@ async fn subvol_snapshot_create(name: &str, label: String) -> Result<()> {
     if !label.starts_with("hive-") {
         bail!("snapshot label {label:?} must start with \"hive-\"");
     }
+    if label.contains("..") {
+        bail!("snapshot label {label:?} must not contain \"..\"");
+    }
     let path = hive_c0re::priv_client::snapshot_agent_subvolume(name, &label)
         .await
         .with_context(|| format!("snapshot {name} state subvolume (label {label:?})"))?;