feat: scaffold codespace backend

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/workspace/path.go

@@ -0,0 +1,25 @@
+package workspace
+
+import (
+	"regexp"
+
+	"codespace/internal/util"
+)
+
+var idPattern = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)
+
+// ValidID reports whether id is a safe workspace identifier: only letters,
+// digits, '-', '_', '.' and non-empty. The bare values "." and ".." are
+// rejected because they would resolve to the parent or current directory.
+func ValidID(id string) bool {
+	if id == "" || id == "." || id == ".." {
+		return false
+	}
+	return idPattern.MatchString(id)
+}
+
+// RootFor returns the absolute workspace root path for the given base root and
+// workspace id. The result is filepath-cleaned.
+func RootFor(baseRoot, id string) string {
+	return util.JoinClean(baseRoot, id)
+}