fix(orgs): enforce root-cause-first org validation

[beruro]

Summary

• reject URL-shaped values at the authoritative local organization write boundary
• add a persistence-layer regression test for orgii, HTTP, and SSH URLs
• add always-on root-cause-first guidance for Cursor, Codex, and Claude agents

Root cause

An ORG2 Cloud invite URI previously reached the local project_create_org path and was persisted as a real project_orgs row. The selector rendered that authoritative row correctly; filtering it in the UI would only hide the upstream invariant violation.

Verification

• cargo test -p project_management create_project_org --lib (4 passed)
• cargo check -p project_management --lib
• cargo clippy -p project_management --lib
• pre-commit scoped cargo clippy
• rustfmt --edition 2021 --check src-tauri/crates/project-management/src/projects/io/orgs.rs
• git diff --check
• AGENTS.md / CLAUDE.md root-cause rule parity check

Audit notes

• authoritative source: projects.db/project_orgs
• producing path: CreateProjectOrgRequest -> project_create_org -> create_project_org
• no selector, Personal Org, Cloud roster, or invite parsing behavior changed
• historical polluted row was separately confirmed empty, deleted, and read back before this PR
• strict clippy -D warnings remains blocked by a pre-existing type_complexity finding in crates/search/src/file/index_cache.rs; normal scoped clippy passes