Align the manual-check name grammar with its documentation and assert history on every resume #388

Priority: P2. Follow-up to PR #387 / #385 (review findings REV-001 and REV-002). No strict dependency; it does not block the manual merge of #387.

Problem and rationale.

1. Documented grammar differs from the implemented one (REV-002). docs/verification.md says a manual check name uses letters, digits, ., _ and -, at most 64 characters. MANUAL_COMMAND in scripts/verification_plan.py also requires the first character to be a letter or digit. A check named manual:_smoke or manual:.live is documented as valid yet is not bound, so its plan fails restore and takes the unrestored fallback. That is the failure Restore manual checks and make plan resume idempotent #385 set out to remove.
2. Resume-history test gap (REV-001). In test_manual_check_survives_three_resumes_with_stable_identities, the proposal=False subtest (unrestored plan, sha256: fingerprints) checks historical results only on the first resume. A later regression that rebuilt results on the second or third resume would still pass.

Objective and scope.

• Names that the documentation calls valid restore. Preferred resolution: accept _ and . as leading characters, keeping compatibility with the grammar already documented, unless a technical or security constraint prevents it. If one does, correct the documentation instead and state the constraint. Either way the authorization model is unchanged: _is_verification_command is not touched and a bound manual command stays non-executable.
• Verify that results, identities and fingerprints survive every resume, not only the first and the last.

Acceptance criteria.

• manual:_smoke and manual:.live restore (or, if the grammar is not widened, are rejected consistently with the documentation, with the reason stated).
• Documentation and MANUAL_COMMAND agree, and a test fails if they diverge.
• After each of at least three consecutive resumes, on both the restored and the fallback paths, the check identities, fingerprints and every earlier result are unchanged and earlier history is a prefix of the later history.
• No change to .code-cycle.yml or to the command allowlist rules.

Regression tests. manual:_smoke and manual:.live; the grammar/documentation agreement test; the per-resume history assertions above, on the proposal=False and proposal=True paths.

Out of scope. Host-attested evidence (#382) and any change to the authorization model.