Function is_safe_asset_id 

fn is_safe_asset_id(id: &str) -> bool

true if id is a safe single filename component: non-empty, within the length cap, and only [a-z0-9._-] (no path separators, no traversal).