按规划继续工作

结论：补齐 OPFS G-code 程序文件名的自定义路径与非法遍历/嵌套路径拒绝验证，覆盖 Node OPFS 与 Chromium OPFS 路径，并通过 host/WASM/browser 聚合验证。

wasm-port/docs/drift-report.md

@@ -71,8 +71,9 @@ semantic rewrites:
   file and G-code storage, parameter/tool-table bridge copying into the
   interpreter SDK filesystem, grouped machine-session loading, explicit
   session file-name overrides, invalid INI-derived machine file names, generic
-  session snapshot custom filenames plus envelope/path rejection paths, and a
-  Chromium localhost round trip for those persistence paths.
+  session snapshot custom filenames plus envelope/path rejection paths, G-code
+  program filename rejection paths, and a Chromium localhost round trip for
+  those persistence paths.
 - Host-side smoke validation is aggregated by
   `tests/host/verify_host_smokes.sh` so Node, WASM, OPFS, and browser checks
   run from one command.