pub fn path_has_parent_escape(path: &Path) -> bool
Reject paths that escape upward via .. before canonicalize (symlink-free check).
..