fix: validate target and hostname inputs to prevent injection

Add input validation to address security concerns:

- Validate Target field in BuildRequest against safe character pattern
  (must be "all" or match alphanumeric/dash/underscore/dot pattern)
- Filter hostnames discovered from nix flake show output, skipping any
  with invalid characters before using them in build commands

This prevents potential command injection via crafted NATS messages or
malicious flake configurations.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/messages/build.go

@@ -45,6 +45,10 @@ func (r *BuildRequest) Validate() error {
 	if r.Target == "" {
 		return fmt.Errorf("target is required")
 	}
+	// Target must be "all" or a valid hostname (same format as revision/branch)
+	if r.Target != "all" && !revisionRegex.MatchString(r.Target) {
+		return fmt.Errorf("invalid target format: %q", r.Target)
+	}
 	if r.Branch != "" && !revisionRegex.MatchString(r.Branch) {
 		return fmt.Errorf("invalid branch format: %q", r.Branch)
 	}