policy-composition 1 Case-variant path aliases in Rust denial gates: anatomy of a canonicalize-fallback bypass Jul 7, 2026