Validate route identifiers as single path segments

[markdorison]

What

Named helpers now reject any org, pipeline, build, number, job, or id argument that isn't a single URL path segment. Invalid values raise Buildkit::InvalidRouteSegment (a subclass of ArgumentError) before any request goes out.

• Added Client#route_segment: an allow list of RFC 3986 unreserved characters that also rejects ., .., empty strings, and nil.
• Wrapped every interpolated identifier in all six helper modules (agents, artifacts, builds, jobs, organizations, pipelines).
• Rejects rather than percent-encodes: Client#request already escapes the whole path, so encoded segments would be escaped twice, and changing that would affect the public get/post/put methods.
• Documented the contract in the README and module docs, and bumped the version to 1.6.2.

Why

Helpers interpolate identifiers into the request path without validating them, so an identifier containing path or query delimiters could send the request to a different endpoint than the helper intends.

Upgrade note

Code that passes a malformed identifier now gets Buildkit::InvalidRouteSegment locally instead of a Buildkit::NotFound from the API. If identifiers come from user input, validate them at your boundary rather than rescuing this error.

Testing

Tests cover: the two reported rerouting cases, a query-only build number, dot segments, a percent-encoded delimiter, empty and nil values, and the ArgumentError contract. The cases span org, build, build number, job, pipeline, and agent id arguments; the existing cassette specs confirm valid identifiers still hit the recorded URLs.