Function resolve_workspace_path 

pub(crate) fn resolve_workspace_path(path: Option<PathBuf>) -> Result<PathBuf>

Resolve the workspace path argument, defaulting to the current directory.

Fails explicitly if the current directory cannot be determined — a security tool must never silently fall back to ".".