fn verify_dir_path(dir: &File, expected: &Path) -> Result<(), VaultToolError>
The opened directory must be the canonical directory the containment check approved, not merely a path that resolved to it a moment later.