fix: validate runtime names before Kubernetes operations

## Problem

The platform runtime tools in `kubeflow_mcp/trainer/api/platform.py` accept a Kubernetes runtime name but do not consistently validate it before processing the request.

Affected functions:

- `create_runtime()`
- `patch_runtime()`
- `delete_runtime()`

Invalid names such as `my runtime`, `INVALID_NAME`, or `runtime/name` can reach preview handling or Kubernetes API calls and produce unclear errors instead of the standard `VALIDATION_ERROR` response.

Other Trainer tools already use the existing `validate_k8s_name()` helper from `kubeflow_mcp/core/security.py`.

## Proposed Fix

Update `kubeflow_mcp/trainer/api/platform.py` to call `validate_k8s_name()` at the beginning of:

- `create_runtime()`
- `patch_runtime()`
- `delete_runtime()`

Validation should happen before patch/spec validation, preview handling, Kubernetes client initialization, and any Kubernetes API call.

## Tests

Add focused tests in `kubeflow_mcp/trainer/api/platform_test.py`.

Verify that:

- Invalid names return `VALIDATION_ERROR`.
- Kubernetes APIs are not called when validation fails.
- Valid names preserve existing behavior.
- Preview and confirmed requests validate names consistently.

## Acceptance Criteria

- All three runtime tools validate names at the tool boundary.
- Invalid Kubernetes names return `VALIDATION_ERROR`.
- Invalid names never reach the Kubernetes SDK.
- Existing valid-name behavior remains unchanged.
- Focused tests, linting, formatting, and the existing test suite pass.