Tighten workspace artifact path handling

internal/state/filesystem.go

@@ -83,8 +83,8 @@ func (s *FilesystemStore) Paths(resolved report.Resolved) (ArtifactPaths, error)
 		return ArtifactPaths{}, fmt.Errorf("state store is required")
 	}
 	metadata := resolved.Metadata()
-	if metadata.RunID == "" {
-		return ArtifactPaths{}, fmt.Errorf("run id is required")
+	if err := validatePathSegment("run id", metadata.RunID); err != nil {
+		return ArtifactPaths{}, err
 	}
 	group := resolved.Definition.ArtifactGroup
 	if group == "" {

internal/state/filesystem_test.go

@@ -69,6 +69,20 @@ func TestDailyPathsUseRunIDValidDateDisambiguator(t *testing.T) {
 	}
 }
 
+func TestPathsRejectRunIDPathSeparators(t *testing.T) {
+	store := newTestStore(t)
+	resolved := resolveDailyAt(t, "2026-05-29T05:00:00-05:00")
+	resolved.Definition.ID = report.ID("daily/bad")
+
+	_, err := store.Paths(resolved)
+	if err == nil {
+		t.Fatal("Paths() error = nil, want invalid run id error")
+	}
+	if !strings.Contains(err.Error(), "run id must not contain path separators") {
+		t.Fatalf("error = %q, want run id path separator context", err.Error())
+	}
+}
+
 func TestBatchDistributorNotificationPathUsesWorkspaceBatchDateAndRunID(t *testing.T) {
 	store := newTestStore(t)
 	location := mustLoadStateLocation(t, "America/Chicago")