pub fn validate_write_path(path: &Path) -> Result<PathBuf>
Sanitize and validate a path for writing (may not exist yet).
Traversal check → validate parent → allowlist.