fix(cli): validate selected local paths before resolution

Reuse the nonempty NUL-free local path contract before normalization in artifact commands, auxiliary inputs, and output destinations. Empty selections now fail at parsing instead of selecting the working directory; explicit relative paths preserve their target.

Public CLI checks cover primary and auxiliary empty paths, exact relative-file digest, explicit current-directory selection, symlink parent semantics, and environment export inputs. Correct the desktop fixture to assert the existing CLI validation envelope.

src/cli/goCommands.ts

@@ -9,6 +9,7 @@ import {
   analysisEvidenceDeliveryOptions,
   deliverCliAnalysisEvidence,
 } from "./analysisEvidenceDelivery.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
 import { machoSliceArchitectureSchema } from "../domain/apple/machoTargetSelection.js";
 
@@ -18,9 +19,9 @@ export const registerGoCommands = (cli: CliInstance, logger: Logger): void => {
     description:
       "Inspect embedded Go compiler, modules and build settings without target execution",
     args: z.object({
-      path: z
-        .string()
-        .describe("Local ELF, PE, thin Mach-O or universal Mach-O image"),
+      path: localPathStringSchema.describe(
+        "Local ELF, PE, thin Mach-O or universal Mach-O image",
+      ),
     }),
     options: z.object({
       ...analysisEvidenceDeliveryOptions,