Function path_is_safe 

pub fn path_is_safe(
    workspace_root: &Path,
    target: &Path,
) -> Result<PathBuf, String>

Enforces the absolute Canonical Traversal lock on the LLM, rendering directory climbing (../) obsolete and blocking any OS-critical reads aggressively by cross-referencing global blacklists.