[Bug]: git trust and review output tests can escape the test tempdir through the host environment

## Summary

The plain-directory trust test ran git without pinning the search ceiling and the review output tests did not guard against ancestor-repository probes, so a host environment with an enclosing git repository (or git walking upward past the tempdir) changes which directory is adopted as the repository root.

The trust test now pins GIT_CEILING_DIRECTORIES at the tempdir parent and feeds a controlled env through the existing inspect_repository_trust_with_env entry point; the invalid lexical .git marker test asserts the marker is never adopted as a repository root and keeps the strict Err when no repository ancestor exists. (No historical red entries for these suites in our CI ledger; this is a defensive host-environment isolation for host-sensitive suites.)

## Area

src/crates/services/services-integrations/src/git/trust.rs (tests) + src/crates/services/services-integrations/src/git/utils.rs (tests). Crate: bitfun-services-integrations (requires the git feature for its test target).

## Reproduction or evidence

At 32f2427697, trust.rs has no GIT_CEILING_DIRECTORIES isolation (only the production inspect_repository_trust_with_env and its callers, :386/:389/:512/:565) and utils.rs has no host_has_repository_ancestor guarding (Grep zero hits); tests therefore pass only on hosts without an enclosing repository. Zero production diff.

## Environment

Hosts whose tempdir sits inside or above a git checkout (developer machines, some CI images); baseline 32f2427697. These suites are not in the remote CI gate (remote only runs file_watch_contracts for this crate) and the local runs are the verification face; disclosed as defensive host-environment isolation.

---
AI-assisted change. Testing: verified locally (`cargo check -p bitfun-services-integrations` exit 0; `--features git --lib trust` 19 passed; `--features git --lib review_git_output` 3 passed, 0 failed).

Start with the tests in src/crates/services/services-integrations/src/git/trust.rs and utils.rs, including inspect_repository_trust_with_env and the review output tests. Run cargo check -p bitfun-services-integrations, then the git-feature trust and review_git_output test targets. Done means the listed tests pass while ancestor repositories and invalid .git markers cannot affect the results.

Written by the indexing model from the issue text.