Add absolute-path containment coverage: traversal escape, and findCoChangePartners/isIndexed call sites

[qmarcelle]

Follow-up coverage deferred from #8 (META-291 resolution-only slice). Both items originated as Sourcery suggestions on that PR and were resolved there without code change, to preserve the reviewed head SHA. Neither is a correctness defect — both are additive coverage over paths already exercised through the shared matcher.

1. Absolute query using .. to escape the root

expect(pathsMatch("/abs/repo/../other/src/db/client.ts", "src/db/client.ts", ROOT)).toBe(false);

Verifies that relative(root, query) together with isRepoRelative rejects traversal-based escape. The rejection branch itself is already covered by the sibling-prefix case (/abs/repo-sibling/... -> undefined); this adds the traversal spelling of the same refusal.

2. Mirror absolute inside/outside-root coverage onto the other workspace-layer callers

tests/unit/workspace.test.ts covers findFragile for both an absolute path inside ws.repositoryRoot and one in a different checkout. Add the analogous pair for:

• findCoChangePartners
• isIndexed

All three call the same pathsMatch(path, key, ws.repositoryRoot), so this demonstrates consistency across the layer rather than testing new logic.

Not in scope here

Same exclusions as #8: no stored-key validation, no symlink/case canonicalization, no permanent corpus harness. The verifyOpts root defect is tracked separately in #7.