[FR]: node fs patches should prevent node from traversing parent directories out of runfiles/sandbox looking for node_modules or package.json

### What is the current behavior?

Node can:
* Find a random `package.json` in some parent directory of the runfiles directory or the sandbox directory. It might even find one outside the workspace (today I observed it finding `$HOME/package.json`). It will look for `"type": "module"` in the first `package.json` it finds as part of the CJS vs ESM determination algorithm.
* Find a package (that would otherwise be missing) in a `node_modules` directory of some parent directory.

Either of these will cause non-hermetic and confusing behavior.

### Describe the feature

The node fs patches should block node from walking parent directories out of the sandbox or runfiles root when performing either of these searches.

(Feel free to close if you think this is infeasible or outside the scope of rules_js. It's just a thought I had after encountering this failure mode for the nth time.)

Start by tracing the repository's node fs patches and how they define the runfiles and sandbox roots. Reproduce the parent-directory searches for package.json and node_modules, then identify or add coverage showing traversal stops at those roots and does not reach the workspace or home directory.

Written by the indexing model from the issue text.