pub fn is_system_path(path: &str) -> bool
Check if a path targets a sensitive system directory.
Returns true if the resolved path matches any blocked system path.
true