feat(server): reject resource names that are not RFC 1123 labels

[mvanhorn]

ax apply accepted any metadata.name. Names were only checked when the controller created the Substrate ActorTemplate / Actor, which require a lowercase RFC 1123 label, so Task-With-Caps was stored and then failed seconds later with a confusing ActorCreationFailed condition (and the template error before it is swallowed as a WARN, see #366). This moves the check to apply time.

Fixes #370

What changed

• pkg/apis/v1alpha1: ValidateName (^[a-z0-9]([-a-z0-9]*[a-z0-9])?$, at most 63 characters, matching Substrate's k8s-short-name) and ValidateObjectMeta, which checks metadata.name and, when set, metadata.atespace (it becomes a Substrate atespace name too; empty still defaults to default in the server). ValidateTask now runs it first; new ValidateWorkspace / ValidateModel do the same for the other kinds.
• internal/server: UpdateWorkspace and UpdateModel call the new validators and return InvalidArgument. UpdateTask already goes through ValidateTask, so it needed no change (this also keeps the diff out of the way of Replace UpdateTask with CreateTask and enforce immutability #398).
• docs/manifests.md: one paragraph on the naming rule.

The error is phrased so it is actionable straight from the CLI:

Error: applying document 1: rpc error: code = InvalidArgument desc = metadata.name: invalid value "Task-With-Caps": must be a lowercase RFC 1123 label: at most 63 lowercase alphanumeric characters or '-', starting and ending with an alphanumeric character

Notes for review:

• An empty name is now rejected too; previously it was saved under the key default/. The shipped examples and demo.sh all use valid names.
• Possible follow-up, deliberately left out to keep the API rule identical to Substrate's: the controller derives <task>-tmpl-<8 hex>, so a task name longer than 49 characters still produces a template name over 63. If you'd like, I can cap task names at 49 in a follow-up.

How tested

• go test ./... (green), go vet ./..., go mod tidy leaves go.mod / go.sum unchanged.
• New tests: TestValidateName (valid / invalid table incl. 63 vs 64 chars, uppercase, _, ., leading / trailing -, whitespace, unicode), TestValidateObjectMeta (name and atespace cases, all three kinds), and internal/server TestUpdate_RejectsInvalidNames (Task / Workspace / Model return InvalidArgument, nothing is persisted, valid names still save). The existing TestValidateTask fixtures just gained a name.
• End to end: built ax and ax-server from this branch, ran ax-server against a local Redis, and applied manifests with an uppercase task name, an underscore workspace name, a dotted atespace, and a valid name (first screenshot).

Evidence

Demo

Full-resolution MP4

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[rakyll]

Can you sign the CLA?

[mvanhorn]

Thanks @rakyll. The CLA was already signed; the commits had the wrong author email, which I've fixed. cla/google is green now on this PR and #405.

[rakyll]

Thank you!