Package names checks names that become file names inside Flowi's own
directories (pinned examples, saved values, digests), so content from a
collection can never choose a path outside them.
AllValid reports whether every name is Valid. Ids and version labels
from a collection become directory names in the workspace data dir, so
code that joins them into a path checks them first: the codec reports a
bad id but still loads it.
Valid reports whether name is safe as a single file name: letters,
digits, '.', '_' and '-', not starting with '.', at most 64 runes. It
rules out separators, "..", hidden files and absolute paths.