Refactor: centralize path, revision, and receipt policies

[jon-devlapaz]

Summary

Collapse duplicated validation and comparison policy for relative repo paths, Git object IDs, and .tink-source.json receipt handling.

Leakage today

Relative path safety (variants of .., leading /, \):

• manifest (normalize_project_path, lock path checks)
• provenance path field
• add locked_path guards

Revision / OID shape (len 40|64 + hex):

• git::remote_head
• provenance::read
• manifest::validate_source

Receipt is not body:

• hash skip of sidecar in manifest::tree_sha256
• equal_except_receipt / skill_contents_equal_except
• library create-only treats receipt-only drift as unchanged
• provenance::SIDECAR_FILE is already shared — comparison policy is not

Design target

• paths::require_relative_repo_path(&str) -> Result<NormalizedRelPath>
• git or paths: require_git_oid(&str) -> Result<&str>
• provenance (or tree): compare_bodies, apply_receipt_only, single ignore-list for sidecar

Acceptance

• One implementation per concern; callers delete local copies
• No CLI behavior change unless tightening invalid pins that already should fail
• Unit tests for reject table (.., absolute, backslash, short OID, etc.)

Priority

Medium — good follow-up after source typing so path rules feed LocalPath construction.