refactor: validate reviewer-name early (fail fast before LLM call)

Moved validateReviewerName check to right after flag parsing. Previously
it ran after the LLM request completed — wasting an expensive API call
if the name was invalid.

Sonnet review finding #1.

cmd/review-bot/main.go

@@ -57,6 +57,11 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Validate reviewer-name: only safe characters allowed in sentinel
+	if err := validateReviewerName(*reviewerName); err != nil {
+		log.Fatalf("%v", err)
+	}
+
 	// Parse repo owner/name
 	parts := strings.SplitN(*repo, "/", 2)
 	if len(parts) != 2 {
@@ -234,10 +239,6 @@ func main() {
 		return
 	}
 
-	// Validate reviewer-name: only safe characters allowed in sentinel
-	if err := validateReviewerName(*reviewerName); err != nil {
-		log.Fatalf("%v", err)
-	}
 	sentinel := fmt.Sprintf("<!-- review-bot:%s -->", *reviewerName)
 
 	log.Printf("Posting review (event=%s)...", event)