Validate ULID checkpoint IDs via oklog/ulid

Replace the hand-rolled Crockford-base32 regex check in KindOf with oklog/ulid's ParseStrict, the same library we'll use to generate ULIDs — so validation and generation agree by construction and we stop maintaining the alphabet by hand. It is also stricter than the char class: it rejects a timestamp overflow (first character > 7).

Canonical form only: isULID also requires v.String() == s, so lowercase and Crockford-normalized aliases (I/L→1, O→0) that ParseStrict tolerates are rejected — we only ever emit the 26-char uppercase canonical encoding, and keeping stored IDs canonical keeps ref names/shards deterministic.

ULIDPattern stays as the loose extraction shape for scanning the Entire-Checkpoint trailer (a regex is needed to find a candidate token in free text); the captured token is then authoritatively validated through this path. The now-unused ulidRegex is removed. Adds the overflow case to the KindOf table.