Expand a leading ~ or ~/ to the user’s home directory. The function is
intentionally forgiving: paths that don’t start with ~ are returned as-is,
and when the home directory cannot be determined the original path is
preserved so callers can surface a downstream error rather than panicking.
Return a canonicalised absolute path that is guaranteed to reside inside the
provided workspace_root. If the path is outside the workspace an error is
returned.