Simplify scope root normalization for nested extension roots

[Mpdreamz]

Why

Follow-up to #3719. That PR fixes the ScopedFileSystem disjoint-roots crash for nested Codex configs by introducing a generic NormalizeDisjointRoots that sorts all roots by length and collapses parent–child pairs. This treats WorkingDirectoryRoot, ApplicationData, and extension roots as equals, but WorkingDirectoryRoot and ApplicationData are fixed and always disjoint — only extension roots can collide with WorkingDirectoryRoot.

Root cause

The codex-environments repo has configs nested inside the checkout:

/home/runner/work/codex-environments/codex-environments/   ← WorkingDirectoryRoot (has .git)
├── .git/
├── environments/
│   └── internal/
│       └── config.yml   ← config passed to `docs-builder codex clone`
└── ...

When a Codex command runs, it calls:

FileSystemFactory.ScopeCurrentWorkingDirectory(fs, [Paths.FindGitRoot(config.FullName)]);

FindGitRoot starts from the config file's directory and walks up looking for .git, but has a depth-1 limit in release builds. The .git is 2 levels up:

environments/internal/   ← depth 0: no .git
environments/            ← depth 1: no .git
repo root/               ← depth 2: .git found, but depth > 1 → REJECTED

Since .git is "too deep", FindGitRoot falls back to returning startDir — the config's own directory:

FindGitRoot("…/environments/internal/config.yml")
  → "/home/runner/…/codex-environments/environments/internal"

Now the original ScopeCurrentWorkingDirectory builds scope roots:

roots = [
  WorkingDirectoryRoot  →  "/home/runner/…/codex-environments"          ← ROOT
  ApplicationData       →  "/home/runner/.local/share/elastic/docs-builder"
  extensionRoot         →  "/home/runner/…/codex-environments/environments/internal"  ← CHILD OF ROOT!
]

.Distinct() doesn't remove anything (they're different strings). roots.Length == 3 ≠ 2, so it doesn't hit the fast path. ScopedFileSystem then enforces that all scope roots must be disjoint (no parent–child relationships):

   ❌ BOOM: ancestor/descendant relationship detected

   /home/runner/…/codex-environments/           ← scope root A
   └── environments/
       └── internal/                            ← scope root B (child of A)

ScopedFileSystem throws here by design — nested roots create policy ambiguity (which root's hidden-file/folder allowlist wins?), so the library forces callers to provide disjoint roots.

What

Replace the generic shortest-first normalizer from #3719 with a targeted filter: drop extension roots that are already covered by WorkingDirectoryRoot using the existing IsSubPathOf extension. No new helper methods needed.

Includes the same two regression tests from #3719 (nested in-repo config, genuinely external config root).