Add cross-platform behavior tests for path-safety on Windows-style inputs

[dgenio]

Summary

Add tests that exercise the path-safety logic against Windows-style inputs (drive letters,
backslashes, UNC) regardless of the host OS, so the documented absolute/UNC bans hold on every
platform the binaries target. Complements open issue #109 (OS matrix CI) at the unit level.

Why this matters

evaluatePathSafety has explicit Windows handling (isUNCPath, isWindowsAbsPath, backslash
normalization), but the logic is exercised by unit tests that may run only on Linux CI. Pinning
the Windows-input behavior in OS-independent unit tests ensures the cross-platform bans never
regress, independent of the OS-matrix CI proposed in #109.

Current evidence

• internal/engine/engine.go evaluatePathSafety, isUNCPath, isWindowsAbsPath handle
  C:/, \\server\share, and backslash normalization.
• CI runs on ubuntu-latest only (.github/workflows/ci.yml); open issue [CI] Run the test suite on a Linux/macOS/Windows matrix #109 proposes a
  Linux/macOS/Windows matrix.

External context

Not required for this issue.

Proposed implementation

1. Add table-driven tests feeding Windows-style strings (C:\\Users\\x, \\\\srv\\share,
   c:/x, mixed slashes) and asserting deny, OS-independently (the logic is lexical).
2. Cross-link [CI] Run the test suite on a Linux/macOS/Windows matrix #109 so the matrix CI and unit tests reinforce each other.

AI-agent execution notes

Inspect: internal/engine/engine.go (path-safety helpers), internal/engine/engine_test.go,
open issue #109. These checks are lexical and OS-independent, so the tests need not run on
Windows to be meaningful. Cover the boundary cases in isWindowsAbsPath (C: exactly, C:/).

Acceptance criteria

• OS-independent tests assert Windows-style absolute/UNC paths are denied.
• Boundary cases in the Windows-path helpers are covered.
• [CI] Run the test suite on a Linux/macOS/Windows matrix #109 is cross-referenced.

Test plan

go test ./internal/engine (runs on any OS).

Documentation plan

None beyond test comments; optionally note cross-platform path handling in the policy docs.

Migration and compatibility notes

Not expected to require migration.

Risks and tradeoffs

Low risk; additive tests for existing behavior.

Suggested labels

testing, reliability, area:engine