pub fn ensure_path_within_workspace(
candidate: &Path,
workspace_root: &Path,
) -> Result<PathBuf>Expand description
Ensure a candidate path is inside the workspace root after lexical normalization.
Returns the normalized candidate path on success.