fix(cli): reject empty native and managed targets before resolution (#7956)

Local file commands in the core binary, native, managed and native-tool
CLI groups declared their positional target as a plain string. An empty
argument therefore reached path admission, where it resolved to the
working directory, as docs/cli.md says it never should.

Declare those targets with the shared nonempty, NUL-free local path
schema already used by analyze, so the CLI rejects them as a
VALIDATION_ERROR naming the field before any analysis runner is called.
Explicit "." is unchanged.

Fixes #7436
Fixes #7404

src/cli/coreNativeCommands.ts

@@ -8,6 +8,7 @@ import {
   MAX_BYTE_SEARCH_MATCHES,
 } from "../domain/native/bytePattern.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 
 import {
   addressOrProcedureGuidance,
@@ -47,7 +48,7 @@ export const registerCoreNativeCommands = (
   cli.command(CLI_COMMANDS.searchBytes, {
     description: "Find masked byte patterns in initialized provider memory",
     args: z.object({
-      path: z.string().describe("Local executable path"),
+      path: localPathStringSchema.describe("Local executable path"),
       pattern: bytePatternFields.pattern,
     }),
     options: z.object({
@@ -103,7 +104,9 @@ export const registerCoreNativeCommands = (
   cli.command(CLI_COMMANDS.inspectNativeLoadImage, {
     description:
       "Inspect native load observations and supported snapshot verification",
-    args: z.object({ path: z.string().describe("Local executable path") }),
+    args: z.object({
+      path: localPathStringSchema.describe("Local executable path"),
+    }),
     options: z.object({
       ...analysisEvidenceDeliveryOptions,
       ...nativeOpenOptionFields,
@@ -133,7 +136,7 @@ export const registerCoreNativeCommands = (
   cli.command(CLI_COMMANDS.readBytes, {
     description: "Read exact provider memory bytes at one analysis address",
     args: z.object({
-      path: z.string().describe("Local executable path"),
+      path: localPathStringSchema.describe("Local executable path"),
       address: z.string().describe("Exact provider memory address"),
     }),
     options: z.object({
@@ -158,7 +161,7 @@ export const registerCoreNativeCommands = (
   cli.command(CLI_COMMANDS.addressToFileOffset, {
     description: "Resolve an analysis address to its original file byte offset",
     args: z.object({
-      path: z.string().describe("Local executable path"),
+      path: localPathStringSchema.describe("Local executable path"),
       address: z.string().describe("Exact provider memory address"),
     }),
     options: z.object({
@@ -177,7 +180,9 @@ export const registerCoreNativeCommands = (
   cli.command(CLI_COMMANDS.traceNativeValues, {
     description: "Trace bounded native def-use and call dependencies",
     args: z.object({
-      path: z.string().describe("Local native executable or app path"),
+      path: localPathStringSchema.describe(
+        "Local native executable or app path",
+      ),
       procedure: nativeValueTraceInputSchema.shape.procedure.describe(
         "Explicit native procedure symbol or address",
       ),
@@ -287,7 +292,9 @@ export const registerCoreNativeCommands = (
           ? "Inspect one native instruction with decoded operand facts"
           : "Resolve one static native call site",
       args: z.object({
-        path: z.string().describe("Local native executable or app path"),
+        path: localPathStringSchema.describe(
+          "Local native executable or app path",
+        ),
         address: z.string().describe("Exact native address"),
       }),
       options: z.object({
@@ -317,7 +324,9 @@ const registerNativeDispatchMetadataCommand = (
   cli.command(CLI_COMMANDS.inspectNativeDispatchMetadata, {
     description: "Inspect typed Objective-C and Swift dispatch metadata",
     args: z.object({
-      path: z.string().describe("Target path used to bind the result evidence"),
+      path: localPathStringSchema.describe(
+        "Target path used to bind the result evidence",
+      ),
     }),
     options: z.object({
       maxRecords: nativeDispatchMetadataInputSchema.shape.max_records.describe(
@@ -355,7 +364,9 @@ const registerNativeUiActionCommand = (
     description:
       "Trace a compiled UI action selector to its native handler and direct callees",
     args: z.object({
-      path: z.string().describe("Target path used to bind the result evidence"),
+      path: localPathStringSchema.describe(
+        "Target path used to bind the result evidence",
+      ),
       action: z
         .string()
         .min(1)
@@ -412,7 +423,7 @@ const registerNativeApiCommand = (
   cli.command(CLI_COMMANDS.inspectNativeApi, {
     description: `Reconstruct one native function API boundary with evidence. ${addressOrProcedureGuidance} ${equalSelectorGuidance}`,
     args: z.object({
-      path: z.string().describe("App or program path"),
+      path: localPathStringSchema.describe("App or program path"),
       address: z
         .string()
         .optional()
@@ -455,7 +466,7 @@ const registerAnnotationCommand = (
   cli.command(CLI_COMMANDS.annotateNativeFunction, {
     description: "Edit function annotations and return refreshed analysis",
     args: z.object({
-      path: z.string().describe("Local executable path"),
+      path: localPathStringSchema.describe("Local executable path"),
       procedure: z
         .string()
         .describe("Exact function entry address or unique name"),