pub fn safe_copy(src: &Path, dst: &Path) -> Result<PathBuf>
Validate both paths and copy file in one atomic step.