fn valid_watch_relative_path(relative: String) -> Option<String>
Reject empty, current-directory, and parent traversal path components.