checkNISTAlignment credited Govern for a .llm-security/policy.json that
merely existed. Since v8.1.0 policy-loader ignores a target's policy
outside the caller's own working tree, so a foreign target (a clone, an
installed package) earned governance credit for a file no scanner reads.
The credit now also requires isOwnWorkingTree(projectRoot).
Red first: the two foreign cases (node_modules package, target outside
cwd) failed; the own-tree known-positive passed before and after.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
