fix(cli): validate selected local paths before resolution

Reuse the nonempty NUL-free local path contract before normalization in artifact commands, auxiliary inputs, and output destinations. Empty selections now fail at parsing instead of selecting the working directory; explicit relative paths preserve their target.

Public CLI checks cover primary and auxiliary empty paths, exact relative-file digest, explicit current-directory selection, symlink parent semantics, and environment export inputs. Correct the desktop fixture to assert the existing CLI validation envelope.

src/cli/pythonPycCommands.ts

@@ -1,4 +1,5 @@
 import { z } from "incur";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
 import { createPythonPycService } from "../composition/pythonPyc.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
@@ -18,7 +19,7 @@ export const registerPythonPycCommands = (
     description:
       "Inspect a supported CPython 3.7–3.13 pyc header and marshal code objects without executing bytecode",
     args: z.object({
-      path: z.string().describe("Local CPython .pyc file"),
+      path: localPathStringSchema.describe("Local CPython .pyc file"),
     }),
     options: z.object({
       maxFileBytes: inspectPythonPycInputSchema.shape.max_file_bytes,