fix(paths): enforce selected path contracts at admission (#9465)

src/cli/coreNativeCommands.ts

@@ -356,7 +356,7 @@ export const registerCoreNativeCommands = (
   cli.command(CLI_COMMANDS.inspectNativeDataType, {
     description: "Inspect one recovered database type or typed data object",
     args: z.object({
-      path: z.string().describe("Local native executable or app path"),
+      path: localPathStringSchema.describe("Local native executable or app path"),
     }),
     options: z.object({
       type: z.string().optional().describe("Exact database type category path"),

src/cli/decompileDirectoryCommand.ts

@@ -26,7 +26,7 @@ export const registerDecompileDirectoryCommand = (
     description:
       "Write every function's pseudocode into a directory and return a manifest",
     args: z.object({
-      path: z.string().describe("App or program path"),
+      path: localPathStringSchema.describe("App or program path"),
     }),
     options: z.object({
       output: localPathStringSchema.describe(

src/cli/nativeCallCommands.ts

@@ -8,6 +8,7 @@ import { logCliCommand } from "../cliLogging.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { nativeCallObservationInputSchema } from "../domain/native/nativeCallObservation.js";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
@@ -24,7 +25,7 @@ export const registerNativeCallCommands = (
     description:
       "Launch a Mach-O under LLDB and record entries into selected functions or Objective-C methods",
     args: z.object({
-      path: z.string().describe("Mach-O or app path"),
+      path: localPathStringSchema.describe("Mach-O or app path"),
       inputJson: z
         .string()
         .describe(