fn safe_relative_path(name: &str) -> Result<PathBuf, &'static str>
Rejects absolute, parent, Windows-prefixed, and control-character paths.