Function is_safe_path_segment 

fn is_safe_path_segment(s: &str) -> bool

Mirrors agentmux_common::data_paths’s private sanitize_path_segment as a boolean check only (that function isn’t pub, and this call site only ever needs to know whether a name discovered on disk is safe to re-join into a path — never the sanitized value itself, since the original bundle_entry path is already known-safe on this filesystem and is what actually gets used). Kept as its own small, stable copy rather than exporting the original: this predicate is simple path hygiene, not the isolation-sensitive logic ensure_history_link and the migration framework’s own “don’t freeze what might change” note are about.