Out-of-tree --config is rejected by the scoped filesystem and reported as a missing file

## Summary

Commands that accept `--config` pointing at a `changelog.yml` outside the current working tree fail, because the `ScopedFileSystem` they read through does not include the config file's own directory as a scope root.

Split out of #3742, where this surfaced. It is **not** a regression from that PR — the same limitation exists on `main`.

## Detail

`ChangelogPrEvaluationService` reads config through the `ScopedFileSystem` it is handed:

```csharp
private readonly ChangelogConfigurationLoader _configLoader =
new(logFactory, configurationContext, fileSystem ?? FileSystemFactory.RealRead);
```

- On `main` this defaults to `FileSystemFactory.RealRead` — scoped to `Paths.WorkingDirectoryRoot` + `Paths.ApplicationData`.
- After #3742, `evaluate-pr` passes `FileSystemFactory.RealReadForCI`, which is the same scope plus `RUNNER_TEMP`.

Neither includes the directory the `--config` path actually lives in, so a config outside the working tree is out of scope.

## Why it is confusing

`ScopedFileInfo.Exists` returns `false` for an out-of-scope path rather than throwing. The failure therefore presents as *"the file does not exist"* even when the file is plainly there on disk, which sends you looking for a typo'd path instead of a scope boundary.

This affects any caller that surfaces existence before reading, not just the changelog commands.

## Repro sketch

```bash
docs-builder changelog evaluate-pr --config /some/path/outside/repo/changelog.yml ...
# reports the config as missing; the file exists and is readable
```

## Possible directions

1. Add the resolved config file's directory as an explicit scope root when a config path is supplied — a short-lived branch in #3742 did this via a `ChangelogPrEvaluationFileSystem` helper, dropped in favour of the simpler `RealReadForCI` factory method.
2. Fold it into `FileSystemFactory` so every `--config`-accepting command benefits rather than one command at a time.
3. Independently: make an out-of-scope read distinguishable from a genuinely missing file, so the diagnostic points at the scope rather than at the path.

Worth deciding whether out-of-tree `--config` is a supported scenario at all before implementing — for CI-only commands the config is always in-repo, so option 3 alone may be sufficient.