fix workspace output and cleanup uncertainty

tools/thothctl/internal/safeio/files_unsupported_unix.go

@@ -0,0 +1,13 @@
+//go:build !windows && !linux && !darwin
+
+package safeio
+
+import "io/fs"
+
+// Unsupported Unix targets fail closed rather than borrowing a platform-specific
+// publication primitive. Add a dedicated implementation only after auditing that
+// target's namespace and no-replace guarantees.
+func ReadCanonicalRegular(string, int64) ([]byte, error)        { return nil, ErrUnsafeFile }
+func writeCanonicalExclusive(string, []byte, fs.FileMode) error { return ErrUnsafeFile }
+func validateCanonicalOutputPath(string) error                  { return ErrUnsafeFile }
+func validatePlatformPathSyntax(string) error                   { return nil }