Fix Windows and Nix test failures

Windows test fixes (bd-web8):
- Add sanitizeMetadataKey() to replace colons with underscores
- Windows absolute paths (e.g., C:\...) contain colons that conflict with
  metadata key separator ':'
- Update tests to use sanitized keys when checking metadata
- Tests now pass on Windows by auto-sanitizing path-based keys

Nix flake fixes (bd-8y1a):
- Update vendorHash in default.nix to match current Go module dependencies
- Hash mismatch was causing Nix build failures in CI

Test improvements:
- Rename TestUpdateExportMetadataInvalidKeySuffix to reflect new behavior
- Test now verifies sanitization instead of rejection
- All tests pass locally

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

default.nix

@@ -9,7 +9,7 @@ pkgs.buildGoModule {
   subPackages = [ "cmd/bd" ];
   doCheck = false;
   # Go module dependencies hash (computed via nix build)
-  vendorHash = "sha256-jpaeKw5dbZuhV9Z18aQ9tDMS/Eo7HaXiZefm26UlPyI=";
+  vendorHash = "sha256-oXPlcLVLoB3odBZzvS5FN8uL2Z9h8UMIbBKs/vZq03I=";
 
   # Git is required for tests
   nativeBuildInputs = [ pkgs.git ];