Variable GRAPH_ID_REGEXConst

Remarks

Per SPEC.md §16.2.1.5, the intersection of "safe in JSON", "safe in URL fragments", and "safe in filesystem paths". The runtime validator (createCausl({ name })) and the schema-3 migration codemod both consume this constant so a regex drift between them is impossible by construction. A unit test asserts the source string is exactly ^[A-Za-z0-9_.:-]{1,256}$ to catch a future PR that loosens the constraint without coordinating.