Function canonicalize_and_enforce_within_workspace 

pub fn canonicalize_and_enforce_within_workspace(
    workspace_root: &Path,
    candidate: &Path,
    tool: &'static str,
    field: &'static str,
) -> Result<PathBuf>

Canonicalize candidate and ensure it remains within workspace_root.

This is symlink-aware: we canonicalize both the workspace root and the candidate path.

If candidate does not exist, we canonicalize its parent directory and then re-join the final path segment, which is sufficient for boundary enforcement prior to a write.