Function resolve_content 

pub fn resolve_content(
    vfs: &Vfs,
    cwd: &str,
    guest_path: &str,
) -> Result<ContentPath, ContainError>

Resolve a guest path for an operation that reaches its contents.

Purely lexical — no filesystem access happens here, so an escape through a symlink surfaces when the returned ContentPath is opened, classified by is_escape.