fix(orgs): enforce root-cause-first org validation

[beruro]

Problem

URL-shaped invite values can reach the authoritative local organization write path and be persisted as real project_orgs rows. Hiding those rows in the UI would leave invalid domain data intact.

Solution

• Reject URL-shaped organization names at the persistence write boundary.
• Add regression coverage for orgii, HTTP, and SSH URLs.
• Record the root-cause-first invariant in the repository’s agent guidance so future fixes target the producing boundary.
• Validation: project-management tests/check/clippy, scoped rustfmt, diff check, and guidance parity checks.

Potential risks

• Validation must not reject legitimate non-URL organization names.
• Historical polluted rows require separate, narrowly confirmed cleanup; this PR does not perform broad data deletion.
• The repository-guidance edits are intentional policy documentation for the same invariant, not runtime behavior.