[Feature] ActorPath as branded type (not just a string)

[pathosDev]

Size / Priority

• Size: S (~100 lines)
• Category: C.3 Type-Safety.
• Risk: medium — heavily-used type.

Affected files

• src/ActorPath.ts.
• All sites that construct or compare ActorPath.

Background

ActorPath.toString() returns a string. Many sites pass it around as string — losing the type distinction.

Branded ActorPath-string would let TypeScript catch:

• Passing arbitrary string where ActorPath expected.
• Constructing ActorPath from arbitrary string without going through validation.

declare const ACTOR_PATH_BRAND: unique symbol;
export type ActorPathString = string & { readonly [ACTOR_PATH_BRAND]: true };

// Smart constructor on ActorPath:
toString(): ActorPathString {
  return this._cached as ActorPathString;
}

// Parser:
parseActorPath(s: string): ActorPathString {
  // validate + cast
}

Coordination

• Pair with [Security] ActorPath.child(name) doesn't reject path-traversal segments #126 (ActorPath path-traversal — adds validation).
• Pair with [Security] Actor names accept control chars, allowing log injection #134 (Actor names control-chars).

Integration / risk

• Public API change.
• Migration: per-site cast or parse.

Test plan

1. Regression: ActorPath tests pass.
2. Type discipline: bare string can't substitute for ActorPathString.
3. Cross-coordination with [Security] ActorPath.child(name) doesn't reject path-traversal segments #126/[Security] Actor names accept control chars, allowing log injection #134 — validation happens at the brand boundary.

Acceptance criteria

• ActorPathString branded type.
• Smart constructors / parsers.
• Per-site migration.
• Coordination with [Security] ActorPath.child(name) doesn't reject path-traversal segments #126/[Security] Actor names accept control chars, allowing log injection #134 (validation).
• No CHANGELOG entry (internal type hardening).