pub fn ensure_extract_path_within(
extract_root: &Path,
rel: &str,
) -> Result<PathBuf, String>Expand description
Resolve a relative path for extraction under extract_root (e.g. git tree checkout).
Rejects .., absolute components, and paths that would escape extract_root.