按规划继续工作

结论：补齐 OPFS G-code 程序文件名的自定义路径与非法遍历/嵌套路径拒绝验证，覆盖 Node OPFS 与 Chromium OPFS 路径，并通过 host/WASM/browser 聚合验证。

wasm-port/docs/source-reuse-map.md

@@ -87,7 +87,8 @@ Current validation is intentionally mechanical:
   filenames under the session directory, and validates its format, version,
   session id, metadata, payload shape, and filename boundary.
   `runtime/opfs/machine-file-store.js` adds pure-text storage for INI, tool
-  table, parameter file, and G-code program content.
+  table, parameter file, and G-code program content, with G-code program
+  filenames constrained by `runtime/opfs/path-model.js`.
   `runtime/opfs/linuxcnc-parameter-bridge.js` copies OPFS-backed parameter
   files into the interpreter SDK filesystem and writes back the LinuxCNC-saved
   parameter file plus backup. `runtime/opfs/linuxcnc-tool-table-bridge.js`