Route the rigs loader through the shared path helper

#1039 collapsed seven copies of the manifest-path containment guard into
`_resolve_pack_path`, and #1040 added an eighth loader carrying its own
copy. Both were correct against the base they were written on and both
merged in the right order, but #1040 went in without the rebase that
would have joined them — so `_load_rigs_file` is now the one loader in
this file still open-coding the guard.

Route it through the helper like its seven siblings. Same behaviour,
same rendered log message ("sloppak: rigs path %r escapes source_dir —
skipped"), verified by triggering a traversal against the new path.
Full suite unchanged at 2796 passed / 4 skipped.

This is the follow-up promised in #1040's description.

Signed-off-by: gionnibgud <gionnibgud@gmail.com>

lib/sloppak.py

@@ -816,16 +816,8 @@ def _load_rigs_file(source_dir: Path, rel: str) -> dict | None:
     realization selection and the `intent.gm` fallback belong to whatever
     voices the part.
     """
-    try:
-        r_path = (source_dir / rel).resolve()
-        r_path.relative_to(source_dir.resolve())
-    except ValueError:
-        log.warning("sloppak: rigs path %r escapes source_dir — skipped", rel)
-        return None
-    except OSError as e:
-        log.warning("sloppak: rigs path resolution failed (%s) — skipped", e)
-        return None
-    if not r_path.exists():
+    r_path = _resolve_pack_path(source_dir, rel, "rigs")
+    if r_path is None or not r_path.exists():
         return None
     try:
         raw = load_json(r_path)