fix: harden template application and parity helpers

[aledbf]

Summary

• create unique extraction directories when no temporary root is supplied and remove them on both success and failure
• preserve caller-owned temporary directories
• support JSONC template metadata and surface standardized config decoding failures
• precompile required-argument regexes and preserve valid Compose separators in parity project names
• add focused regression coverage for every changed behavior

This supersedes the broken autofix in #16 and completes the intended fixes from #17.

Validation

• go test ./internal/cli -run Test(NormalizeRequired|ComposeProjectName)$
• go test ./internal/templates
• task lint
• task spec:compliance
• task parity:contract with the Node 24 oracle: 68 matched, 0 failed
• full race suite passed with only TestResolveBuildAuthFromOCIEnvAndGitHubToken excluded because it reads ambient Docker credentials from the developer host

The PR also provides a fresh event for the CodeQL nightly bundle selected through the github-codeql-tools repository property.

[github-code-quality]

Code Coverage Overview

Languages: Go

Go / code-coverage/go

The overall line coverage in commit 801e236 in the fix/code-quality-fin... branch remains at 52%, unchanged from commit ab721fa in the main branch.

Show a line coverage summary of the most impacted files.

File	main ab721fa	fix/code-quality-fin... 801e236	+/-
internal/templates/apply.go	85%	84%	-1%