fix(types): allow ':' and '/' in snapshot names for OCI tag-aware refs

[tonicmuroq]

Summary

• types.SnapshotConfig.Validate() rejects names containing : or /, which breaks vk-cocoon's tag-aware local-snapshot naming (repo:tag, e.g. simular/ubuntu-hot-testing:v1).
• Split: keep validName strict for VMConfig (hostname / DNS-1123 / cidata constraints apply), introduce validSnapshotName allowing : and / for SnapshotConfig.
• Shell-unsafe chars and leading non-alnum remain rejected for snapshots.

Failure mode this fixes

Real downstream symptom in vk-cocoon's PullSnapshot (vk-cocoon/snapshots/puller.go):

ERR ... create error="ensure snapshot simular/ubuntu-hot-testing:v1: stream snapshot: copy blob sha256:8ff765e3...: write |1: broken pipe"

What actually happens on a cocoon snapshot import --name simular/ubuntu-hot-testing:v1 (vk-cocoon's exec):

$ echo | cocoon snapshot import --name "simular/ubuntu-hot-testing:v1"
Error: snapshot name "simular/ubuntu-hot-testing:v1" is invalid: must match ^[a-zA-Z0-9][a-zA-Z0-9._-]{0,62}$ (max 63 chars)

The cocoon subprocess hits validation before reading stdin → exits non-zero → vk-cocoon writes the blob into a closed pipe → EPIPE bubbles up as "broken pipe". The real validation error is invisible to upstream because vk-cocoon's command() doesn't capture subprocess stderr — that's a separate vk-cocoon bug worth a follow-up.

Affects every cocoon VM create that goes through vk-cocoon PullSnapshot, not just Linux — the only reason Windows wasn't flagged yet is the existing CocoonSets all predate the cocoon binary rebuild that picked up #61.

Why the split (vs. keeping a single regex)

#61's rationale — Linux HOST_NAME_MAX=64, DNS-1123 labels, cidata YAML — applies to VM names, which propagate into the guest hostname, network identity, and cidata. Snapshot names are local cocoon DB keys: they are matched in localfile by string equality, never written into a filesystem path (data dirs key off the generated ID, not the name), and never reach hostname / DNS / cidata. So the strict charset is correct for VMConfig.Name and over-restrictive for SnapshotConfig.Name. The split is intentional rather than relaxing validName globally.

Test plan

• go test ./types/... — passes (15 cases in TestSnapshotConfig_Validate, including new simular/ubuntu-hot-testing:v1, repo:tag, leading : / leading /, semicolon, backtick).
• go vet ./... — clean.
• go build ./... — clean.
• make lint — not run locally (golangci-lint not installed on this host); expecting CI to vet.

Follow-ups (not in this PR)

• vk-cocoon vm/cocoon_cli.go:command() should capture cmd.Stderr so future cocoon subprocess failures surface the real error instead of an upstream EPIPE symptom. Would have made this bug a 5-minute fix instead of an afternoon.