[Bug]: git trust and review output tests can escape the test tempdir through the host environment

## Summary

The plain-directory trust test ran git without pinning the search ceiling and the review output tests did not guard against ancestor-repository probes, so a host environment with an enclosing git repository (or git walking upward past the tempdir) changes which directory is adopted as the repository root.

The trust test now pins GIT_CEILING_DIRECTORIES at the tempdir parent and feeds a controlled env through the existing inspect_repository_trust_with_env entry point; the invalid lexical .git marker test asserts the marker is never adopted as a repository root and keeps the strict Err when no repository ancestor exists. (No historical red entries for these suites in our CI ledger; this is a defensive host-environment isolation for host-sensitive suites.)

## Area

src/crates/services/services-integrations/src/git/trust.rs (tests) + src/crates/services/services-integrations/src/git/utils.rs (tests). Crate: bitfun-services-integrations (requires the git feature for its test target).

## Reproduction or evidence

At 32f2427697, trust.rs has no GIT_CEILING_DIRECTORIES isolation (only the production inspect_repository_trust_with_env and its callers, :386/:389/:512/:565) and utils.rs has no host_has_repository_ancestor guarding (Grep zero hits); tests therefore pass only on hosts without an enclosing repository. Zero production diff.

## Environment

Hosts whose tempdir sits inside or above a git checkout (developer machines, some CI images); baseline 32f2427697. These suites are not in the remote CI gate (remote only runs file_watch_contracts for this crate) and the local runs are the verification face; disclosed as defensive host-environment isolation.

---
AI-assisted change. Testing: verified locally (`cargo check -p bitfun-services-integrations` exit 0; `--features git --lib trust` 19 passed; `--features git --lib review_git_output` 3 passed, 0 failed).

src/crates/services/services-integrations/src/git/trust.rs と utils.rs のテストから始め、inspect_repository_trust_with_env と review 出力のテストを含めます。cargo check -p bitfun-services-integrations を実行し、その後 git-feature trust と review_git_output のテストターゲットを実行します。完了とは、列挙されたテストが成功し、祖先リポジトリと無効な .git マーカーが結果に影響を与えられないことです。

索引モデルが issue の本文から書いたものです。