this actually was defective even with local urls... as we pass files through the portal the sandbox gets irrelevant portal paths a la /run/foo/bar/yolo.txt when the sandbox then gives us that path back, the directory isn't meant to be written to, much less shown to the user to begin with.
to deal with this scenario we now do a reverse resolution dance on savefile. notably we first ask the portal to translate the portal file name in /run to the actual file name underneath it. we then run that path through kio-fuse in case it was fuse mounted
this renders /run to /home/foo/yolo.txt or when it was fuse mounted for example smb:///foo/yolo.txt
the effective end result is that when you open a file in okular from a samba share and then save-as, the file save dialog will show the smb:// url not the fake /run url