Function validate_workspace_path 

pub fn validate_workspace_path(
    workspace_root: &Path,
    user_path: &str,
) -> Result<PathBuf, String>

Verify that user_path resolves within workspace_root. Returns the canonicalized file path on success, or an error message suitable for the tool response.

Walks up the ancestor chain to find the nearest existing directory, then canonicalizes that ancestor to resolve symlinks/junctions. This prevents an intermediate symlink pointing outside the workspace from bypassing the check when the deeper path components don’t exist yet.