fix(isLocale): reject hyphens inside numeric variants

[FanWu-ai]

isLocale accepts malformed tags such as de-CH-190- and en-1--a. The digit-leading variant branch uses [A-Z-a-z0-9], which includes a literal hyphen, allowing empty or truncated subtags to pass.

Remove the unintended hyphen from that character class. RFC 5646 §2.1 defines this variant form as a digit followed by three alphanumeric characters: https://www.rfc-editor.org/rfc/rfc5646.html#section-2.1

The regression keeps valid digit-leading variants, multiple variants, and the library's existing underscore delimiter support covered.

Validation (Node.js 24.19.0):

• The new regression failed on unchanged source: isLocale("de-CH-190-") passed but should have failed.
• Baseline npm test: 323 passing.
• Final npm test: 324 passing; all generated builds and ESLint passed; statements, lines, and functions remain at 100% coverage.
• git diff --check passed.

Tests ran with HOME and npm cache redirected to writable temporary directories. No checks were disabled. No generated distributions are included.

Prepared with OpenAI Codex. The reproduction and local checks above were executed in the development environment.

Checklist

• Only related source and regression tests
• README reviewed; the documented contract does not change
• Regression tests written
• RFC reference provided