Function validate_workspace_scope 

pub fn validate_workspace_scope(
    requested: &Path,
    workspace_root: &Path,
) -> Result<PathBuf, String>

Ensure path is the workspace root or a subdirectory of it (after canonicalization).