fix: add missing validation in renameAlias, add 6 tests

renameAlias was missing length (>128), reserved name, and empty string
validation that setAlias enforced. This inconsistency allowed renaming
aliases to reserved names like 'list' or 'delete'.

Also adds tests for:
- renameAlias empty string, reserved name, and length limit
- validate-skills whitespace-only SKILL.md rejection
- validate-rules whitespace-only file and recursive subdirectory scan

scripts/lib/session-aliases.js

@@ -310,15 +310,28 @@ function renameAlias(oldAlias, newAlias) {
     return { success: false, error: `Alias '${oldAlias}' not found` };
   }
 
-  if (data.aliases[newAlias]) {
-    return { success: false, error: `Alias '${newAlias}' already exists` };
+  // Validate new alias name (same rules as setAlias)
+  if (!newAlias || newAlias.length === 0) {
+    return { success: false, error: 'New alias name cannot be empty' };
+  }
+
+  if (newAlias.length > 128) {
+    return { success: false, error: 'New alias name cannot exceed 128 characters' };
   }
 
-  // Validate new alias name
   if (!/^[a-zA-Z0-9_-]+$/.test(newAlias)) {
     return { success: false, error: 'New alias name must contain only letters, numbers, dashes, and underscores' };
   }
 
+  const reserved = ['list', 'help', 'remove', 'delete', 'create', 'set'];
+  if (reserved.includes(newAlias.toLowerCase())) {
+    return { success: false, error: `'${newAlias}' is a reserved alias name` };
+  }
+
+  if (data.aliases[newAlias]) {
+    return { success: false, error: `Alias '${newAlias}' already exists` };
+  }
+
   const aliasData = data.aliases[oldAlias];
   delete data.aliases[oldAlias];