fix(scope): a clone under cwd is not the caller's own working tree

isOwnWorkingTree() treated any target at or below cwd as own, so a foreign
clone under cwd (cwd = $HOME, a vendor clone in a project) still had its
.llm-security-ignore, policy.json and custom SIG rules read. The target must
now also share cwd's git root: nearest ancestor with a `.git` entry (dir for
a clone, file for a submodule/worktree), or none for both. No git spawn.
tmpdir stays foreign. Chosen per the PM order: it is exactly the line
between "my repo" and "something I fetched", and the failure direction is
safe (foreign => config ignored => more findings, never fewer).

Red first: tests/lib/own-working-tree.test.mjs 4 fail / 5 pass (the 5 are
known-positives), tests/scanners/nested-clone-scope.test.mjs 5 fail / 4 pass
on the old rule. Green after; reverting the git-root comparison turns 9 red.
Suite 2306 / 2300 pass / 0 fail / 6 skip; hooks 370/0 (implicit root
untouched); golden 109/7/4, 61/61.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Fixed
+
+- **A clone under the working directory is no longer "own working tree".**
+  v8.1.0 honoured `.llm-security-ignore` and `.llm-security/policy.json`
+  (including `sig.custom_rules_path`) for any target at or below the working
+  directory, so a foreign clone there — the working directory at `$HOME`, or a
+  cloned vendor folder inside a project — could still suppress or tune its own
+  scan. The target must now also have the same git root as the working
+  directory: the nearest folder above it holding a `.git` (a directory for a
+  clone, a file for a submodule or worktree), or no git root for either
+  (`scanners/lib/own-working-tree.mjs`). Temp-directory targets stay foreign.
+
+  **Behaviour change:** scanning a nested clone, submodule or worktree from
+  the parent repository no longer applies that checkout's ignore file or
+  policy; it now gets the defaults and one stderr line per ignored file.
+  Scanning the repository itself or any plain folder inside it is unchanged,
+  and so are hooks, which read the policy from the project root.
+
 ## [8.1.0] - 2026-09-22
 
 Antivirus surface. A Windows user should be able to clone the repository and