Validate node IDs at the mint-port wiring boundary

`mintPortWiring` passes `id as NodeId` into `getNodeById`, bypassing the existing ID conversion/validation boundary. The same file already uses `parseWidgetId` for widget events; preserve that correctly parsed path.

Verified at upstream commit `686a91971eccaec062b39830764b04e5d0aa8a03` in [mintPortWiring.ts](https://github.com/Comfy-Org/ComfyUI_frontend/blob/686a91971eccaec062b39830764b04e5d0aa8a03/src/workbench/extensions/agent/crdt/mintPortWiring.ts), inside `source.serializeNode`.

Use the established node-ID constructor/guard where incoming IDs cross this boundary. Add a focused lint rule for branded-ID assertions outside the type definitions, with an explicit inventory of existing exceptions. Distinguish actual branded identifiers from unrelated types whose names happen to end in `Id`.

Acceptance:

- Valid supported node IDs resolve the same nodes; invalid IDs are rejected or handled explicitly.
- A newly introduced branded-ID cast outside the approved boundary fails lint.
- Existing graph serialization and CRDT mint-port tests pass.

This follows the type-safety guidance in `docs/guidance/typescript.md` and the entity-ID constraints in `AGENTS.md`. Upstream transfer for FE-2115; implementation belongs in this repository.

Start in src/workbench/extensions/agent/crdt/mintPortWiring.ts at source.serializeNode, and compare its node-ID handling with the existing parseWidgetId path. Read docs/guidance/typescript.md and AGENTS.md, then locate the graph serialization and CRDT mint-port tests. Done means valid IDs still resolve, invalid IDs are handled explicitly, and the lint rule rejects unapproved branded-ID casts while recording exceptions.

Written by the indexing model from the issue text.