Function ensure_path_within_workspace 

pub fn ensure_path_within_workspace(
    candidate: &Path,
    workspace_root: &Path,
) -> Result<PathBuf>

Ensure a candidate path is inside the workspace root after lexical normalization.

This is the cheap, filesystem-free tier of workspace containment: it resolves ./.. components lexically but does not follow symlinks. Use ensure_path_within_workspace_resolved when the candidate may traverse symlinks that point outside the workspace.

Returns the normalized candidate path on success.