fix(cli): validate selected local paths before resolution

Reuse the nonempty NUL-free local path contract before normalization in artifact commands, auxiliary inputs, and output destinations. Empty selections now fail at parsing instead of selecting the working directory; explicit relative paths preserve their target.

Public CLI checks cover primary and auxiliary empty paths, exact relative-file digest, explicit current-directory selection, symlink parent semantics, and environment export inputs. Correct the desktop fixture to assert the existing CLI validation envelope.

src/cli/environmentCommands.ts

@@ -1,4 +1,5 @@
 import { basename } from "node:path";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
 import type { EnvironmentExportResult } from "../application/environment/environmentExport.js";
 import type { EnvironmentSource } from "../application/environment/environmentSource.js";
@@ -393,16 +394,13 @@ const registerExportCommand = (cli: CliInstance, logger: Logger): void => {
       "Export an environment manifest and its capture Evidence as an agent environment bundle folder the agentenv framework runs with agent-env run",
     args: z.object({
       manifest: manifestArgument,
-      directory: z
-        .string()
-        .describe(
-          "Bundle directory to create; must be absent or empty, nothing is overwritten",
-        ),
+      directory: localPathStringSchema.describe(
+        "Bundle directory to create; must be absent or empty, nothing is overwritten",
+      ),
     }),
     options: z.object({
       evidence: evidenceOption,
-      packageTarball: z
-        .string()
+      packageTarball: localPathStringSchema
         .optional()
         .describe(
           "Packed rea-agents tarball (npm pack) copied into the env folder and installed by the Dockerfile instead of the registry package pinned to this version",