FLX-2112: the run id is not a safe identifier

Family: plan/replay binding (the 2000 band)

A run id is not a name a caller chooses: it is the first 16 hex characters of the plan's own planDigest, so the only well-formed value is 16 lowercase hex digits ([0-9a-f]{16}). Anything else -- a path, a word, an uppercase spelling, a longer or shorter string -- names no run this engine could have written, and <state_dir>/runs/<run id> is a path component, so the check runs before the join. fluxsim plan prints the value; pass that to --run-id.

Look it up offline

$ fluxsim explain FLX-2112

Every code is listed in the error index.