Function validate_path_access 

pub fn validate_path_access(
    resolved: &Path,
    working_dir: &Path,
) -> Result<(), String>

Validate that a resolved path is safe to access.

Returns Ok(()) if the path is within the working directory or an allowed global config location. Returns Err(message) if the path would escape the project boundary (e.g., via ../../../etc/passwd).

Allowed paths outside working_dir:

• ~/.opendev/ (user config, memory, skills)
• ~/.config/opendev/ (XDG config)
• /tmp/ (temporary files)