fn confine_to_root(root: &Path, candidate: &Path) -> Result<PathBuf, String>Expand description
Fold .. out of candidate and require what is left to sit inside root.
Lexical rather than canonicalize, the same way media_server::resolve_path
does it: the file usually does not exist yet, so canonicalising would fail on
the ordinary case. The check has to come after the caller’s join, because
Path::join drops the base when the joined half is absolute — such a path is
not folded, it is obeyed, and only the starts_with below catches it.
TRACES: DR-211 | UT-205