The path already split on ".".
true when the whole write must be refused.
The "last one included" is the whole point and was the Sprint 5 bug: a
single-segment path ("__proto__") skips the descent loop entirely and lands
straight on the final assignment, so a guard that only covers the loop leaves the
shortest possible attack open. Callers must refuse the entire write rather than
skip a segment — a partially-applied path writes to somewhere nobody asked for.
Returns true when ANY segment of a dotted path is unsafe — the last one INCLUDED.