fix(panicbot): rename colon-named findings file + fail-loud filename guard

Panicbot Sweep failed 3 consecutive weekly runs (06-14/06-21/06-28):
actions/upload-artifact rejects ':' in paths, and one legacy file
(shared-context/findings/indieweb2-bastion/2026-02-14T00:00:00Z.json —
the only colon path in the tree) failed the whole sweep's artifact upload.

The writer (scripts/submit-finding.sh) already emits colon-free names
(%Y%m%d-%H%M%S), so the file is residue from an older path, not a live
writer bug — renamed to 2026-02-14T00-00-00Z.json. Added a fail-loud
pre-upload guard that names any future offender instead of letting the
upload step fail cryptically (fail loudly; the guard points at the writer).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/panicbot-sweep.yml

@@ -107,6 +107,21 @@ jobs:
           echo "- **Mode**: ${{ inputs.mode || 'advisor' }}" >> "$GITHUB_STEP_SUMMARY"
           echo "- **Scope**: ${{ inputs.scope || 'all' }}" >> "$GITHUB_STEP_SUMMARY"
 
+      # upload-artifact rejects ':' in paths; a single legacy colon-named file
+      # failed the whole sweep for 3 consecutive weeks. The writer
+      # (scripts/submit-finding.sh) already emits colon-free names — this guard
+      # fails LOUDLY (naming the offender) if any regressed writer reintroduces
+      # one, instead of the upload step failing cryptically.
+      - name: Guard — no artifact-illegal filenames
+        if: always()
+        run: |
+          BAD=$(find shared-context/findings -name '*:*' -print)
+          if [ -n "$BAD" ]; then
+            echo "::error::Colon-named findings file(s) break artifact upload — fix the writer, then rename:"
+            echo "$BAD"
+            exit 1
+          fi
+
       - name: Upload findings artifact
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1