Function is_path_within 

pub fn is_path_within(canonical: &Path, allowed_paths: &[PathBuf]) -> bool

Returns true if canonical is contained within (or equal to) at least one of allowed_paths.

canonical must already be canonicalized (symlinks resolved) by the caller — this function performs no filesystem access itself, so it is safe to call on a path that does not fully exist yet (e.g. FileExecutor’s ancestor-resolved-but-not-yet-created target).