ComfyUI Base 2.9.2: the testbed finds a consumer repository's packages again

2.6.0 moved testbed.sh into the base, which changed $HERE by one level and silently broke the glob that
locates the packages. $HERE/..//packages// from /base/comfyui-base resolves to
/base//packages// and matches nothing.

MEASURED on a reconstructed consumer layout: zero matches. The testbed would have provisioned the base's own
packs and none of the package's, and the comfyui tier would have run against a tree missing the very packs it
exists to exercise - green, and meaningless.

This is exactly the failure BASE_SH was fixed for in the same release; its sibling went unnoticed because a
standalone base has no packages either way, so it is the one shape where both the broken and the working code
behave identically, and it was the only shape the suite could see. The new test builds a consumer layout.

The root is searched for now, one level up then two, and a candidate counts only when it holds a
/-script.sh - two levels up from a standalone checkout is an unrelated directory that could hold
somebody else's packages. --status also prints what it derived and where from, because silent derivation is
how this shipped in the first place.

Proven on all three layouts: base-as-submodule (a per-workflow repository), testbed.sh beside the base (the
pre-2.6.0 brand layout), and a standalone base clone.

---

Step one on a fresh machine:

python3 -m zipfile -e comfyui-base.zip . && bash comfyui-base/comfyui-base-script.sh