Remediate the 2026-09-03 feature-test findings

plugins/geenforce/api/routes.py

@@ -454,6 +454,15 @@ def create_scope():
     if not scopename:
         return error_response(ErrorCodes.VALIDATION_ERROR,
                               'scopename is required', http_code=400)
+    # The name becomes a directory on the imaging share. Refused here as well
+    # as at the write, so a bad name never reaches the database in the first
+    # place - see valid_scopename for what a traversing name did.
+    if not service.valid_scopename(scopename):
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'scopename may contain only letters, digits, dot, dash and '
+            'underscore, and must start with a letter or digit',
+            http_code=400)
     if phase not in PHASES:
         return error_response(ErrorCodes.VALIDATION_ERROR,
                               f'phase must be one of {PHASES}', http_code=400)