Function is_safe_tool_id 

fn is_safe_tool_id(s: &str) -> bool

Tool ids feed straight into the catalog match in resolve_install_step — same shape constraint as install_handlers::is_safe_provider_id (short, alnum + _/-), kept as its own function rather than reused so this module’s validation doesn’t silently drift if that one’s constraints ever change for provider-id-specific reasons.