Function tasks_path_checked 

pub fn tasks_path_checked(ito_path: &Path, change_id: &str) -> Option<PathBuf>

Build a tasks path only when the change id is a safe path segment. Path to {ito_path}/changes/{change_id}/tasks.md when change_id is safe.

This rejects path traversal tokens, path separators, empty ids, and overlong ids to ensure the resulting path cannot escape the intended changes/ subtree.