fix: address second round of code-review findings

actions.js:
- Add assertValidRepo/assertValidIssueNumber guards at the top of all
  action handlers (applyClaim, applySync, applyValidate, applyPublish,
  applyReview, applyDecompose, applyUnblock) for fast-fail validation
- applyValidate: fix status transition — set 'validated' unconditionally
  when ok=true instead of preserving 'blocked' (was inconsistent with
  projectState becoming 'ready')

gh-api.js:
- runGh: preserve GITHUB_TOKEN by default; only delete when caller
  explicitly sets options.stripGithubToken=true (was deleting by
  default, breaking CI)

parsing.js:
- extractCoordinationState: throw SyntaxError on malformed JSON instead
  of silently returning null — lets callers distinguish bad JSON from
  absent marker
- normalizeBodyForComparison: fix regex to match JSON-quoted form
  "lastSyncAt": ... instead of bare lastSyncAt: ...

policy.js:
- loadPolicy: validate that parsed JSON is a plain object before
  spreading; coerce nested fields (labels, review, validation,
  branchModel, project, fieldNames) to objects before merging

state.js:
- assertIssueClaimable: block re-claim on status alone (not status AND
  owner) to prevent {status:'claimed', owner:null} bypass; use
  state.owner || 'unknown' in error message
- getCoordinationState: catch SyntaxError from extractCoordinationState,
  log warning to stderr, fall back to default state

tests/lib:
- Update malformed-JSON test to expect SyntaxError throw instead of null

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/lib/github-coordination.test.js

@@ -100,7 +100,7 @@ const DESCRIPTORS = [
   },
   {
     group: 'extractCoordinationState',
-    name: 'extractCoordinationState returns null when JSON block is malformed',
+    name: 'extractCoordinationState throws SyntaxError when JSON block is malformed',
     fn: () => {
       const body = [
         '<!-- ecc-coordination:start -->',
@@ -109,8 +109,7 @@ const DESCRIPTORS = [
         '```',
         '<!-- ecc-coordination:end -->',
       ].join('\n');
-      const result = extractCoordinationState(body);
-      assert.strictEqual(result, null);
+      assert.throws(() => extractCoordinationState(body), SyntaxError);
     },
   },