model: validate VM names as DNS labels at CLI + daemon

A VM name flows into five places that all have narrower grammars
than "arbitrary string":

  - the guest's /etc/hostname  (vm_disk.patchRootOverlay)
  - the guest's /etc/hosts      (same)
  - the <name>.vm DNS record    (vmdns.RecordName)
  - the kernel command line     (system.BuildBootArgs*)
  - VM-dir file-path fragments  (layout.VMsDir/<id>, etc.)

Nothing in the chain was validating the input. A name with
whitespace, newline, dot, slash, colon, or = would produce broken
hostnames, weird DNS labels, smuggled kernel cmdline tokens, or
(in the worst case) surprising traversal through the on-disk
layout. Not host shell injection — we already avoid shelling out
with the raw name — but a real correctness and supportability bug.

New: model.ValidateVMName. Rules:

  - 1..63 chars (DNS label max per RFC 1123; also a comfortable
    /etc/hostname cap)
  - lowercase ASCII letters, digits, '-' only
  - no leading or trailing '-'
  - no normalization — the name is the user-visible identifier
    (store key, `ssh <name>.vm`, `vm show`); silently rewriting
    "MyVM" → "myvm" would hand the user back something different
    than they typed

Called from two places:

  - internal/cli/commands_vm.go vmCreateParamsFromFlags — rejects
    bad `--name` values before any RPC. Empty name still passes
    through so the daemon can generate one.
  - internal/daemon/vm_create.go reserveVM — defense in depth for
    any non-CLI RPC caller (SDK, direct JSON over the socket).

Tests:

  - internal/model/vm_name_test.go — exhaustive character-class
    matrix (space, newline, tab, dot, slash, colon, equals, quote,
    control chars, unicode letters, uppercase, leading/trailing
    hyphen, over-length, max-length-exact, digits-only).
  - internal/cli TestVMCreateParamsFromFlagsRejectsInvalidName —
    CLI wire-through + empty-name passthrough.
  - internal/daemon TestReserveVMRejectsInvalidName — daemon
    defense-in-depth (including `box/../evil` path-traversal).
  - scripts/smoke.sh — end-to-end rejection + no-leaked-row
    assertion.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/daemon/vm_create.go

@@ -115,6 +115,14 @@ func (s *VMService) reserveVM(ctx context.Context, requestedName string, image m
 		}
 		name = generated
 	}
+	// Defense in depth: CLI has already validated the flag, but any
+	// other RPC caller (SDK, direct JSON over the socket) lands here
+	// without going through the CLI flag parser. The name flows into
+	// /etc/hostname, kernel boot args, DNS records, and file paths —
+	// it has to be DNS-label-safe.
+	if err := model.ValidateVMName(name); err != nil {
+		return model.VMRecord{}, err
+	}
 	// Exact-name lookup. Using FindVM here would also match a new name
 	// that merely prefixes some existing VM's id or another VM's name,
 	// falsely rejecting perfectly valid names.

internal/daemon/vm_create_test.go

@@ -86,3 +86,40 @@ func TestReserveVMRejectsExactDuplicateName(t *testing.T) {
 		t.Fatalf("err = %v, want 'already exists'", err)
 	}
 }
+
+// TestReserveVMRejectsInvalidName pins defense-in-depth: the CLI
+// already validates, but any other RPC caller (banger SDK, direct
+// JSON over the socket) lands here without going through the CLI.
+// The name ends up in /etc/hostname, kernel boot args, DNS records,
+// and file paths — the daemon must refuse anything that isn't a
+// valid DNS label.
+func TestReserveVMRejectsInvalidName(t *testing.T) {
+	ctx := context.Background()
+	tmp := t.TempDir()
+	d := &Daemon{
+		store:  openDaemonStore(t),
+		layout: paths.Layout{VMsDir: filepath.Join(tmp, "vms"), RuntimeDir: filepath.Join(tmp, "runtime")},
+		config: model.DaemonConfig{BridgeIP: model.DefaultBridgeIP},
+	}
+	wireServices(d)
+
+	image := testImage("image-x")
+	image.ID = "image-x"
+	image.Name = "image-x"
+	if err := d.store.UpsertImage(ctx, image); err != nil {
+		t.Fatalf("UpsertImage: %v", err)
+	}
+
+	for _, bad := range []string{
+		"MyBox",       // uppercase
+		"my box",      // space
+		"my.box",      // dot
+		"box\n",       // newline
+		"-box",        // leading hyphen
+		"box/../evil", // path separator + traversal
+	} {
+		if _, err := d.vm.reserveVM(ctx, bad, image, model.VMSpec{VCPUCount: 1, MemoryMiB: 128}); err == nil {
+			t.Fatalf("reserveVM(%q) = nil error, want rejection", bad)
+		}
+	}
+}