pub(crate) fn validated_file_key(file: &Path) -> Result<String, CliError>
Normalize and validate a user-supplied path as a repository-relative file key.