fix: harden task1 workspace output and publication

tools/thothctl/internal/safeio/files.go

@@ -18,6 +18,9 @@ func ValidateCanonicalPath(path string) error {
 	if !filepath.IsAbs(path) || filepath.Clean(path) != path || strings.Contains(path, string(filepath.Separator)+".."+string(filepath.Separator)) {
 		return ErrUnsafeFile
 	}
+	if err := validatePlatformPathSyntax(path); err != nil {
+		return err
+	}
 	return nil
 }