Resolve workflow-gate repo root from the edited file's path, not cwd

[joshft]

Summary

hooks/workflow-gate.sh resolved the repo root — and therefore the workflow
state file and the gate branch — from the hook's current working directory
rather than from the repo that owns the edited file. Edits to files living in a
sibling git worktree or separate checkout were gated by the cwd repo's active
phase and false-blocked, even though the file's own repo had no active workflow.
The only workaround (workflow-advance.sh override) mutated the wrong workflow's
state and burned its override budget.

Fix

Re-resolve REPO_ROOT — and the derived CONFIG_FILE, ARTIFACTS_DIR,
STATE_FILE, and gate branch — from the edited file's nearest existing ancestor
directory (git -C <dir> rev-parse --show-toplevel). Fall back to the cwd-based
root when the file is not in any git repo or its directory is unresolvable — the
pre-existing behavior, not a new fail-open path. Bash tool calls (no file path)
keep cwd resolution. PAT-001 fail-closed posture is preserved throughout.

Tests

• New RED→GREEN repro in tests/test-workflow-gate.sh
  (test_sibling_repo_file_not_gated_by_cwd_workflow): an edit to a file in a
  separate repo with no active workflow is now allowed (exit 0); a regression
  guard confirms same-repo restrictive-phase edits are still blocked (exit 2).
• Full suite: 102/0. test-dynamic-rigor.sh: 260/0.
• CI-superset: shellcheck (--severity=warning), sync.sh --check, and
  check-no-pending-sfg-lift.sh all clean.

Provenance

Resolved autonomously by /cchores with agent-separated TDD — one agent wrote
the failing repro test, a separate agent wrote the fix. Verified GREEN and
CI-superset-clean before opening.

Closes #242