fix(snapshot): refuse receipt paths that escape the handed directory

[VARUN3WARE]

Summary

• Closes [Bug]: Snapshot verify can read outside the handed directory via receipt paths #469: verify_dataset_snapshot reuses _validated_relative_key and raises (CLI exit 2) before reading absolute / .. / drive-letter receipt paths.
• Threat model: not local privilege escalation; restores the documented “joined only onto the handed directory” promise for markers we did not write (tenant-supplied snapshots).
• Built on the fix(snapshot): refuse markers whose format identity the exporter would refuse #486 / fix(snapshot): enforce the receipt inventory content_id at verify time #483 boundary gates already on main.

Test plan

• Relative ../, absolute path, and tables/../../… (subdir present) → exit 2
• Honest relative export still verifies clean
• tests/test_snapshot_verify.py + tests/test_dataset_snapshot.py
• CI green

[kstonekuan]

LGTM, merging.

Reusing _validated_relative_key is the right call: the verifier and storage roots now give one answer to "is this key inside the root".

Checked it against the three shapes from the issue plus the ones that must still pass:

../outside/secret.bin           REFUSE
/etc/hostname                   REFUSE
tables/../../outside/secret.bin REFUSE
C:\Windows\x                    REFUSE
samples.parquet                 accept, unchanged
assets/wrist_cam/frame_01.jpg   accept, unchanged

It normalizes ./a and a//b, which our exporter never writes and which does not reach the digest (_inventory_content_id hashes record.path).