fix(cli): validate selected local paths before resolution

Reuse the nonempty NUL-free local path contract before normalization in artifact commands, auxiliary inputs, and output destinations. Empty selections now fail at parsing instead of selecting the working directory; explicit relative paths preserve their target.

Public CLI checks cover primary and auxiliary empty paths, exact relative-file digest, explicit current-directory selection, symlink parent semantics, and environment export inputs. Correct the desktop fixture to assert the existing CLI validation envelope.

src/cli/modelCommands.ts

@@ -6,6 +6,7 @@ import { safeParseJson } from "../domain/safeJson.js";
 import { z } from "incur";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
 import { createModelArtifactService } from "../composition/model.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
@@ -25,7 +26,9 @@ export const registerModelCommands = (
     description:
       "Inspect GGUF or safetensors headers without loading model weights",
     args: z.object({
-      path: z.string().describe("Local model file, detected by content"),
+      path: localPathStringSchema.describe(
+        "Local model file, detected by content",
+      ),
     }),
     options: z.object({
       ...analysisEvidenceDeliveryOptions,