Select the best project root from MCP client roots.
Only considers paths that are existing directories.
Prefers roots with project markers (.git, Cargo.toml, etc.).
Falls back to the first valid directory if none have markers — but never
accepts a broad/unsafe root (HOME, filesystem root, agent sandbox dirs),
which would otherwise contaminate sessions across projects.
Parse a file:// URI to a validated local path string.
Rejects non-file URIs, null bytes, .. traversal, and non-directory paths.
Returns a canonicalized absolute path.