action.yml PATH_INPUT validation and ambient workspace

Validate inputs.path as a safe concrete relative checkout path before every Action side effect, under LC_ALL=C: each slash-separated segment must match ASCII [A-Za-z0-9_.-]+ and must not be empty, ., .., __proto__, or start with -. This preserves paths such as packages/CLI while blocking traversal, prototype, and option-like values. Clear CRAFT_WORKSPACE for both Craft invocations unless an explicit Action workspace input is supplied, so inherited ambient selection cannot diverge from controller state.