fix(collaboration): validate remote collaborator ids

[seonghobae]

Closes #309

Scope

• read remote user and id only from own enumerable data descriptors without executing accessors
• reject blank, numeric-only, over-80-code-point, and over-1,024-code-unit source identifiers before counting
• keep host awareness failures contained and continue counting later valid entries after hostile shapes

Dependency boundary

This Draft is stacked on #407 / exact base 7a7093b92616296be6b4c3c7ce990880d12f8271, reusing its allocation-free public identifier bound. The #309 delta changes one source file and adds one focused test file.

Exact-head local evidence

For exact head 55965a8d69c51801bc1b56a8293763a8fc1a0ec2:

• RED on test-only 4c05915: 5 failed / 1 passed
• focused GREEN: 3 files / 48 tests passed
• pnpm test: 161 files / 907 tests passed
• pnpm run coverage: 100% statements, branches, functions, and lines
• pnpm run typecheck: passed
• pnpm run build: passed
• pnpm run verify:package: passed

Local and predecessor evidence does not transfer approval or protected-main authority. Keep Draft until the dependency chain integrates or is otherwise resolved, and while #118 owns the protected release boundary.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh exact-head validation for 55965a8: remote collaborator identity tests plus the inherited awareness suite passed 46/46 tests. This covers descriptor-only reads (no accessor execution), hostile identifier bounds, numeric/blank rejection, and continued counting after malformed entries. pnpm run typecheck passed. The PR remains Draft and stacked on #407; no protected-main merge or release claim is made.