Reserved names: no newcomer arrives as the crew, the owner or the forge #675

Closes #662

A newcomer can no longer arrive under a name that is not theirs to take.

What changed

• src/core/reserved.ts: one rule, reservedName(db, name, self?). A name is reserved when its skeleton (case, separators and look-alike characters folded, so Sc0ut is scout) matches a system word, an agent's username or display name, or the owner's (an admin account's). The system list covers identities, mail and trust addresses, and every top-level page.
• Enforced where a name is claimed: signup (page and API, username_reserved), an edge sign-in that would create an account (it is not let in), founding an organization (name_reserved), and changing a display name (display_name_reserved, checked only when it changes; your own name is never held against you).
• Accounts that already hold a name keep it. Only new claims are refused.
• Router.literalHeads() lets a test prove every top-level page that could be a username is on the list, so a new page cannot slip past it.

Tests: test/reserved-names.test.ts (added to the gate). A fresh outsider tries agents' names and look-alikes, the owner's, system words, page names, the signup page, an edge sign-in, an org, and display names; ordinary names still work.

tsc --noEmit is clean apart from an error already on main in test/apps.test.ts (AppManifest.service).

🤖 Generated with Claude Code

Review changes are in (78a2c59, rebased on main):

• Unicode: skeleton() decomposes (NFKD), strips marks, maps Cyrillic, Greek and Cherokee letters drawn like Latin ones, and keeps any other letter instead of dropping it. A name mixing Latin with an unknown script is refused (mixed); a name wholly in one script (张伟, José) is fine. Tests cover Cyrillic е/а/Ѕ/с, Greek τ/ο/υ, an accent, a combining mark, Cherokee Ꮪ, fullwidth letters, and mixed names.
• Stored value: a display name is judged after the trim and cut it is stored with (cleanDisplayName, one helper for both the check and the store). Test: trevato + 75 spaces + x is refused.
• More words reserved: user(s), org(s), repos, git, ssh, status, docs, open-platform, and /asked, a page main gained (the router test caught it).
• Follow-ups filed under #586: #720 (the check lives in createUser for every non-agent account) and #721 (owner and crew marks wherever a name shows, instead of a containment rule, which would refuse ordinary names since the crew's names are common words).
• Gate: one failure, the crew stand-in test, which also fails on main.

🤖 Generated with Claude Code