fix(uninstall): validate bundle_id format before defaults delete

ByHost cleanup already guards with a regex but defaults delete did not,
leaving an inconsistent validation boundary.