refactor: use path-aware filesystem containment checks (#7420)