fix(resume): validate --task slug before overwriting _active.md (v3.4.14)

[kengio]

Problem

Found during the adversarial review round of #241: /resume --task=<slug> (resume SKILL.md Step 1.3) overwrote the active-thread pointer _active.md BEFORE Step 2 checked whether any pause file exists for that slug. A mistyped slug therefore rewrote the pointer into an orphan (Step 2.3 only warns and stops), silently deactivating the previously active thread.

Change

• Validate-then-write: the explicit --task slug is now checked before the pointer is touched — the pause-file glob must return ≥1 match; on zero matches /resume reports "No pause file found — active thread unchanged" and stops without writing.
• Slug shape gate (from this PR's own adversarial review): the --task value must be plain kebab-case before it is interpolated into the glob — a value like * would otherwise match any thread's files, "pass" validation, and write a corrupt pointer. The same shape check is added at /pause --task's thread-switch entry point, closing the class at both places user-typed slugs enter the pointer/glob path (pointer-derived slugs elsewhere only ever come from these validated writers).
• Pointer-write failure stop: if the _active.md overwrite itself fails, /resume stops instead of announcing a thread the pointer does not record (mirrors /pause's write-failure contract).
• Step 2's orphan-pointer warning is now reachable only for a genuine orphan pointer read from _active.md; the "same rule as /resume Step 2" cross-reference in pause's Auto-Finalize section is unaffected.
• Plugin version 3.4.13 → 3.4.14 (both .claude-plugin and .codex-plugin manifests) + CHANGELOG entry.

Review

Risk-scaled pre-PR review: one cold adversarial pass (contract/failure-behavior — walked every /resume path and the /pause --task interaction) and one repo-consistency/deliverable pass (whole-repo stale-reference sweep, version-bump precedent, changelog accuracy). The adversarial pass's Important finding (glob-metacharacter slug) and two Minor findings (write-failure handling, step-numbering ambiguity) were fixed in the second commit; the consistency pass's changelog wording nits are folded in as well.

🤖 Generated with Claude Code