fix: add validation for config and reply subjects

Address medium severity security issues:

- Validate repo names in config only allow alphanumeric, dash, underscore
  (prevents NATS subject injection via dots or wildcards)
- Validate repo URLs must start with git+https://, git+ssh://, or git+file://
- Validate ReplyTo field must start with "build.responses." to prevent
  publishing responses to arbitrary NATS subjects

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/messages/build.go

@@ -3,6 +3,7 @@ package messages
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
 )
 
 // BuildStatus represents the status of a build response.
@@ -55,6 +56,10 @@ func (r *BuildRequest) Validate() error {
 	if r.ReplyTo == "" {
 		return fmt.Errorf("reply_to is required")
 	}
+	// Validate reply_to format to prevent publishing to arbitrary subjects
+	if !strings.HasPrefix(r.ReplyTo, "build.responses.") {
+		return fmt.Errorf("invalid reply_to format: must start with 'build.responses.'")
+	}
 	return nil
 }