Governance gates silently accept an ambient root override

`packages/comfy-multi-player/scripts/check-pins.mjs:57`, `check-purity.mjs:27` and `check-stateless.mjs:16` each resolve their root as `process.env.PINS_ROOT|PURITY_ROOT|STATELESS_ROOT ?? `, and none prints the root it settled on, so a variable left in a shell or job environment makes all three report a verdict about a different tree while looking exactly like a normal pass. The overrides are needed by `test/{purity,stateless,upstream-pins}.test.ts`, which set them to fixture paths, so the fix is not to remove them but to make the choice visible.

Proposed fix: log the resolved root on every run, or accept the override only as an explicit `--root` flag so an ambient variable cannot reach it.

Priority: low. Nothing runs these in CI today. Noted while reviewing #16778.