Function validate_workspace_bound 

pub fn validate_workspace_bound(
    command: &str,
    workspace_root: &Path,
) -> Result<()>

Validate that a command is workspace-bound.

Checks parsed command parts for absolute paths that escape the given workspace root. Returns Ok(()) when all path-like arguments resolve inside the workspace, or an error describing the violation.