fix(check): honor --base scope when workspace is a repo subdirectory

[laurigates]

Severity: HIGH — silent gate bypass

surf check --base <ref> can pass (exit 0) despite real, anchored drift whenever
surf.toml lives in a subdirectory of the git repo (the monorepo / nested-package
layout). This is the exact diff-scoped mode action.yml recommends for PR gating, so the
bypass lands squarely on the CI path.

Root cause

git::changed_files runs git diff --name-only <base>. Without --relative, git emits
repo-root-relative paths (e.g. proj/src/x.rs), while Anchor.file is
workspace-root-relative (src/x.rs). The two sets never intersect, so Scope::includes
filters out every claim → zero claims checked → clean exit.

Reproduction (before fix)

repo/
  proj/
    surf.toml
    src/m.rs        # anchored `add`, hash stored for `a + b`
    hubs/a.md

With a + b committed and the working tree changed to a - b:

• surf check → exit 1 (DIVERGED) ✅
• surf check --base HEAD → exit 0 ("all anchored spans match") ❌ bypass

When the workspace is the repo root, both report exit 1 — which is why the existing
base_scope_limits_to_changed test never caught it.

Fix

Add --relative to the diff so git emits workspace-root-relative paths. It is a no-op when
the workspace is the repo root, and it additionally drops changes outside the workspace
(which can never be anchored). One-line change in surf-cli/src/git.rs.

Test

Adds base_scope_works_when_workspace_is_a_repo_subdir, which initializes the repo at the
parent of the workspace and asserts a working-tree drift still fails check --base. It
fails without the fix (left == right assertion: 0 vs 1) and passes with it.

cargo clippy --all-targets clean; full suite green (180 tests).

Part of an ongoing security/correctness review of Surface.

🤖 Generated with Claude Code