[P1] Harden workflow API PRD option token validation

[brAperia2025]

Context: CodeRabbit feedback on upstream PR coleam00#1875 surfaced a likely-valid security issue in our fork.

Problem:

• packages/server/src/routes/api.ts accepts prdId and sourceBranch as arbitrary strings.
• These values are later concatenated into /workflow run command text.
• Values containing whitespace or flag-like tokens can smuggle unintended options, e.g. --resume-run-id.

Impact:

• P1; P0 if the Archon API/server is exposed to untrusted users.

Acceptance criteria:

• Validate prdId and sourceBranch before command construction.
• Reject whitespace, leading dash, and embedded --, or replace command-string concatenation with safe argv-style construction.
• Add tests for valid tokens and rejected injection attempts.

Reference:

• CodeRabbit comment: Merge AISRV Archon state model into dev coleam00/Archon#1875 (comment)