Fix path-scoped Git in nested repositories

[PracticalSwan]

Summary

• resolve the nearest Git top-level for path-scoped Git operations when it is inside the allowed workspace
• keep existing behavior for unscoped Git calls and workspaces nested inside a parent repository outside the allowed root
• add a wide non-Git root + nested repo smoke regression

Fixes the nested-Git portion of #91.

Verification

• npm run build
• node scripts/smoke.mjs
• git diff --check