Function normalize_workspace_relative_path 

pub fn normalize_workspace_relative_path(
    value: &str,
    workspace_root: &str,
) -> Option<String>

Returns a slash-separated path relative to workspace_root when value is a safe path within that workspace.

Paths are normalized lexically so matching does not depend on the host OS or require the path to exist. A .. segment is rejected rather than collapsed, preventing traversal from becoming matchable. Absolute paths must have the workspace as a whole-component prefix; relative paths are interpreted as workspace-relative. Backslashes are accepted so persisted rules and tool inputs behave consistently on Windows.

This is the canonical normalization shared by ask-rule matching and rule persistence: callers that save a file ask rule should store the value this returns so the saved path matches the same invocation later. None means the path is empty, traversing, drive-relative, or outside the workspace and must not be turned into a rule.

Case is preserved on case-sensitive filesystems and folded on case-insensitive ones, matching what the host actually considers the same file. See platform_paths_are_case_insensitive.