[Bug]: format.check complains on github actions?

### What happened?

```bash
bazel run --remote_cache=$GOOGLE_BUCKET --google_default_credentials //tools/format:format.check

INFO: Invocation ID: 709f2bff-6786-4357-bda9-6aa0e57a56a4
Computing main repo mapping:
Loading:
Loading: 0 packages loaded
Analyzing: target //tools/format:format.check (1 packages loaded, 0 targets configured)
Analyzing: target //tools/format:format.check (1 packages loaded, 0 targets configured)

Analyzing: target //tools/format:format.check (12 packages loaded, 38 targets configured)

INFO: Analyzed target //tools/format:format.check ([15](https://github.com/loeffel-io/ls-lint/actions/runs/15439449655/job/43453570586#step:8:16) packages loaded, 2458 targets configured).
INFO: Found 1 target...
Target //tools/format:format.check up-to-date:
bazel-bin/tools/format/format.check.bash
INFO: Elapsed time: 2.975s, Critical Path: 0.34s
INFO: 10 processes: 10 internal.
INFO: Build completed successfully, 10 total actions
INFO: Running command line: bazel-bin/tools/format/format.check.bash
fatal: detected dubious ownership in repository at '/__w/ls-lint/ls-lint'
To add an exception for this directory, call:

git config --global --add safe.directory /__w/ls-lint/ls-lint
fatal: detected dubious ownership in repository at '/__w/ls-lint/ls-lint'
To add an exception for this directory, call:

git config --global --add safe.directory /__w/ls-lint/ls-lint
```

### Version

Development (host) and target OS/architectures:

Output of `bazel --version`: 8.2.1

Version of the Aspect rules, or other relevant rules from your
`WORKSPACE` or `MODULE.bazel` file: 1.4.2

Language(s) and/or frameworks involved:

Go

### How to reproduce

```shell
https://github.com/loeffel-io/ls-lint/actions/runs/15439449655/job/43453570586
```

### Any other information?

_No response_

Start by rerunning the linked GitHub Actions job and the `//tools/format:format.check` entry point. Inspect the generated `tools/format/format.check.bash` command and verify that the format check completes without Git's dubious-ownership error in the Actions workspace.

Written by the indexing model from the issue text.