test(set-workspace): segment-aware .. assert + reset override after API tests

Two test-hygiene follow-ups from a structured re-review of PR #22; no
production code changes.

1. tests/test_workspace_path_validation.py — test_returns_canonical_path_collapsing_dotdot
   The canonical-path assertion was a substring check against `..` on
   the raw realpath string. That would spuriously fail if the OS-supplied
   tempdir name ever embedded `..` in a folder component — substring
   presence is the wrong primitive for the invariant we actually care
   about, which is "no `..` *segment* in the canonical path." Switched
   to `Path(result).parts`, which handles `\` vs `/` natively and
   asserts on path components.

2. tests/test_workspace_path_validation.py — TestSetWorkspaceApi.setUp
   The 200-path test mutates the module-global _workspace_path_override
   in utils/workspace_path.py via the API, and the tempdir it then
   points at is rmtree'd by the existing cleanup. Without an explicit
   reset, the global stays pinned at a now-deleted path across tests.
   Added addCleanup(set_workspace_path_override, None) so any future
   sibling test inspecting the override sees a clean None.

Full suite: 152/152 OK (skipped=2 POSIX-only symlink tests on Windows).
No behaviour change; ReadLints clean.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: clean6378-max-it

tests/test_workspace_path_validation.py

@@ -15,6 +15,7 @@
 import sys
 import tempfile
 import unittest
+from pathlib import Path
 
 REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 sys.path.insert(0, REPO_ROOT)
@@ -56,7 +57,10 @@ def test_returns_canonical_path_collapsing_dotdot(self):
         traversal_input = os.path.join(storage, "..", os.path.basename(storage))
         result = validate_workspace_path(traversal_input)
         self.assertEqual(result, os.path.realpath(storage))
-        self.assertNotIn("..", result)
+        # Assert no `..` *segment* in the canonical path (vs. a substring check
+        # on the raw string, which would spuriously fail if the OS-supplied
+        # tempdir name ever embedded `..` in a folder name).
+        self.assertNotIn(os.pardir, Path(result).parts)
 
     # ─── Hard rejects ──────────────────────────────────────────────
 
@@ -149,9 +153,15 @@ class TestSetWorkspaceApi(unittest.TestCase):
     def setUp(self):
         from flask import Flask
         from api.config_api import bp as config_bp
+        from utils.workspace_path import set_workspace_path_override
 
         self.tmp = tempfile.mkdtemp(prefix="cursor-validate-api-test-")
         self.addCleanup(shutil.rmtree, self.tmp, ignore_errors=True)
+        # Reset the module-global workspace override after each test. The
+        # 200-path test below mutates it via the API and the tempdir is then
+        # rmtree'd by the cleanup above — without this, a future sibling test
+        # inspecting the override would see a stale, now-deleted path.
+        self.addCleanup(set_workspace_path_override, None)
 
         app = Flask(__name__)
         app.config["TESTING"] = True