In the copy and clean logic, "clean" does remove and preserve according to remove_regex and preserve_regex. Logically, this removal should only happen within source_root for the library. But since source_root, remove_regex and preserve_regex are all constructed from repo root, this is not enforced in the code.

We should enforce this at runtime to not touch anything outside of source_root. Optionally, validate from state.yaml when parsed.

context: #1849 (comment)