fn validate_name(name: &str) -> Result<()>
Reject names containing path separators or traversal components.