Resolves the absolute path of the durable bank-token store.
An unset, empty or whitespace-only override is treated as absent, so a
blank environment variable never yields an unusable path. Otherwise the
override is returned as written, not normalised, once it passes every
check in `PATH_RULES`. Unsafe segments are refused rather than rewritten,
because rewriting them is what made lexical and on-disk resolution disagree.
Repeated separators and `.` segments resolve the same both ways once device
prefixes are refused, so they pass through.
Returns string
The absolute bank-token store path.
Throws
ConfigurationError naming the first rule the override breaks.
Resolves the absolute path of the durable bank-token store.
An unset, empty or whitespace-only override is treated as absent, so a blank environment variable never yields an unusable path. Otherwise the override is returned as written, not normalised, once it passes every check in `PATH_RULES`. Unsafe segments are refused rather than rewritten, because rewriting them is what made lexical and on-disk resolution disagree. Repeated separators and `.` segments resolve the same both ways once device prefixes are refused, so they pass through.