v0.121.8

Point the packaging manifests at the repository's current GitHub owner, and answer the changelog-exemption question in the repository a caller names rather than wherever the process stands.

Context

The repository moved to a new GitHub owner, but package.json and the Python
project URLs still named the old one. That is more than a stale link: the npm
publish workflow asserts a build attestation naming the current owner, and the
manifest's repository.url contradicted it, so the npm leg of the 0.121.7
publish was rejected with E422 while the tag and the GitHub Release went out
normally. The repository and issue links now follow the repository. The
documentation-site links and the author handle are unchanged -- neither of
them is a repository URL.

The second fix closes a trap rather than a live defect. Coverage is two
questions asked of one repository: which commits an entry names, and which
commits the exemption rules excuse. The helper took an explicit working
directory and applied it to the first question only; the exemption predicates
shelled out to git with no working directory at all, so they reported on
whatever repository the process happened to stand in. Asking about one
repository from inside another returned commits as uncovered that the named
repository plainly exempts, because their trailers and file lists were read
somewhere else entirely. No shipped flow was wrong, since every invocation
today resolves its project from the working directory -- but a parameter that
governs half a function's work is a defect waiting for its first caller. The
working directory now runs the whole length of the question, and the
regression test asks about one repository while standing in another.

Fixes

• Fixed. The npm package's repository and issue links named an owner that no longer holds the repository, which also made the npm publish fail its build-attestation check and reject the release.