fix(#2391): reject ".." in credential/snapshot names (path-traversal hardening)

Per mara's review: validate_credential_name allowed any [A-Za-z0-9_.-]
byte sequence, which permits a literal ".." substring. Not currently
exploitable (snapshot_path() embeds the label inside a single
format!()'d path component with no "/" in the allowed charset, so
there's no directory to traverse into), but it's a landmine for any
future caller that builds a path via PathBuf::from(name) directly
instead of the current string-embedding. Reject ".." outright in the
shared validator, plus a matching client-side check in hivectl for
fail-fast UX (hive-priv's copy is still the authoritative one).

hive-priv/src/main.rs

@@ -455,6 +455,16 @@ fn validate_credential_name(name: &str) -> Result<()> {
     {
         bail!("invalid credential name {name:?}: must be non-empty [A-Za-z0-9_.-]");
     }
+    // `.` is in the allowed charset (systemd credential ids and snapshot
+    // labels both legitimately use dots), but a bare `..` reads as a
+    // directory-traversal token to anyone auditing this path — and a
+    // caller that builds a path via `PathBuf::from(name)` instead of the
+    // current `format!("...{name}...")` embedding would actually be
+    // exploitable. Reject it outright rather than relying on every future
+    // caller getting the embedding right.
+    if name.contains("..") {
+        bail!("invalid credential name {name:?}: must not contain \"..\"");
+    }
     Ok(())
 }