Harden ranked synchronization boundaries

[flemming-n-larsen]

Review findings fixed

• allow practice configuration without a registered clientId, while ranked mode still fails before repository access when identity is absent
• reject repository and contract URLs carrying query strings or fragments so credentials cannot leak through clone arguments or diagnostics
• reject catalog bot paths that are absolute, non-bots/, empty-segmented, or traversal-bearing
• keep every test at exactly one Cliewen purpose tag

Verification

• ./gradlew clean build --rerun-tasks
• live read-only sync against robocode-dev/rumble-data revision e24fe58032cd6b119542ddd74d2f4423ba8d279a

Follow-up audit and fix for merged PR #2.