Shared team instructions bypass executable text validation

PR #4220 puts agent and persona instructions under one literal review and validation contract. Team names and instructions remain outside it, even though team instructions are shared and executed at launch.

A team can still carry hidden or bidirectional text through local create or update, relay sync, publication, or snapshot import. That leaves the same executable text safer in an agent definition than in the team wrapped around it.

The follow-up should:

- validate the prospective team name and instructions before local create or update;
- validate inbound kind 30176 before retention and publication as defense in depth;
- validate team snapshot fields before preview or confirmation;
- preserve ordinary whitespace and supported Unicode while rejecting the same concealed controls as agent definitions;
- cover each production ingress and prove a failed update leaves no partial write.

This is the agreed follow-up from #4220. It keeps shared executable instructions under one review contract without broadening that PR after merge.