fix(init): validate apply-patchset paths generically

[betegon]

Summary

Moves install patch path safety to the CLI apply-patchset tool boundary. The tool now rejects absolute paths, drive-prefixed paths, backslashes, empty segments, ., and .. as normal tool errors, while still allowing ordinary nested project-relative files like .csproj paths.

This pairs with the cli-init-api change that stops hardcoding package-manager metadata filenames: https://github.com/getsentry/cli-init-api/pull/170.

Test Plan

• pnpm exec biome check src/lib/init/tools/apply-patchset.ts test/lib/init/tools/filesystem-tools.test.ts
• pnpm exec vitest run test/lib/init/tools/filesystem-tools.test.ts

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cli.sentry.dev/_preview/pr-1042/
Built to branch gh-pages at 2026-06-01 11:18 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

Codecov Results 📊

✅ Patch coverage is 80.65%. Project has 4296 uncovered lines.
✅ Project coverage is 82.03%. Comparing base (base) to head (head).

Files with missing lines (1)

File	Patch %	Lines
src/lib/init/tools/apply-patchset.ts	80.65%	⚠️ 6 Missing and 2 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    81.99%    82.03%    +0.04%
==========================================
  Files          329       329         —
  Lines        23883     23908       +25
  Branches     15603     15630       +27
==========================================
+ Hits         19581     19612       +31
- Misses        4302      4296        -6
- Partials      1651      1650        -1

---

Generated by Codecov Action