fix: avoid host Git discovery in Bazel sandboxes

[4og]

Bazel sandboxed docs actions can walk out of execroot and discover a host Git worktree, causing ubproject.toml to be written outside the project. Stop Git-root discovery when the fallback working directory is inside execroot, and add a regression test. This intentionally relies on Bazel's execroot layout; it only covers the fallback path, while bazel run continues to use BUILD_WORKSPACE_DIRECTORY.

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //src:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: cef7bc59-ed46-4ea8-9197-48ea8a81fa1e
Computing main repo mapping: 
Loading: 
Loading: 0 packages loaded
Loading: 0 packages loaded
WARNING: Target pattern parsing failed.
ERROR: Skipping '//src:license-check': no such target '//src:license-check': target 'license-check' not declared in package 'src' defined by /home/runner/work/docs-as-code/docs-as-code/src/BUILD
Analyzing: 0 targets (1 packages loaded)
ERROR: no such target '//src:license-check': target 'license-check' not declared in package 'src' defined by /home/runner/work/docs-as-code/docs-as-code/src/BUILD
INFO: Elapsed time: 6.478s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

[github-actions]

Documentation preview for this pull request is available at:
pr-705: https://eclipse-score.github.io/docs-as-code/pr-705/