feat(auth): add profile rename and make write verbs safe

[howar31]

Why

Storing a second bot without --name silently lands it under the default
label, and there was no way to relabel it afterwards. Fixing that surfaced two
adjacent problems in the same command group.

What

• dscrd auth rename <old> <new> [--force] — relabel a stored profile.
  When the renamed profile is the active one, active follows it; otherwise
  every later command would resolve against a profile that no longer exists.

• --dry-run now works across the auth group. All four write verbs carry
  the write annotation, which makes the generated skill advertise
  --dry-run — but none of them checked the flag, so a command run to preview
  it wrote for real. They now preview through dryRunLocal. Local verbs have
  no API response, so they honor --dry-run only, not --raw.

• set-token no longer clobbers silently. A stored token cannot be read
  back, so a mistyped --name destroyed another bot's credential with no way
  to recover it. Overwriting now requires --force, and falling back to the
  default label is called out in the output.

• Profile names are validated as [A-Za-z0-9_-]+ on write only, keeping
  them safe as bare TOML keys without invalidating configs written earlier.

• auth status sorts its listing instead of leaking Go's map iteration order.

Verification

• go test ./... green, including TestZZAllCommandsCovered,
  TestSkillsTreeInSync and TestNoForeignBranding.
• New cases cover: active-follows-rename, non-active leaves active alone,
  target-taken rejected then accepted with --force, same-name and
  missing-source rejected, invalid names rejected, and all four verbs leaving
  the config byte-identical under --dry-run.
• A rename preserves the encrypted token: auth test --profile <new> resolves
  against an httptest server after the rename.
• Manual end-to-end run against an isolated DSCRD_CONFIG, 12 scenarios.

Notes

Updating an existing profile's --default-guild now also requires --force
and re-supplying the token. README documents this and recommends passing
--default-guild during initial setup instead.

VERSION is intentionally untouched — release bumps are their own PR.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.