fix: avoid invoking git before project trust is established

[viyatb-oai]

Summary

• resolve trust roots by inspecting .git entries on disk instead of spawning git rev-parse --git-common-dir
• keep regular repo and linked-worktree trust inheritance behavior intact
• add a synthetic regression test that proves worktree trust resolution works without a real git command

Testing

• just fmt
• cargo test -p codex-core resolve_root_git_project_for_trust
• cargo clippy -p codex-core --all-targets -- -D warnings
• cargo test -p codex-core (fails in this environment on unrelated managed-config DangerFullAccess tests in codex::tests, tools::js_repl::tests, and unified_exec::tests)

[bolinfest]

This looks good, though my one post-commit piece of feedback is that the docstring (or some comment in the code) should explain that we are deliberately avoiding running git for security purposes, just so someone doesn't come along later and replace this implementation with git rev-parse --git-common-dir.