Harden changelog CI path: scope roots, SecurityException, native gate errors

[cotti]

Summary

Follow-up hardening on top of #3742 (RealReadForRunnerTemp / ChangelogPrBodyReader), plus the gate-logic change requested by @[colleague] to make evaluate-pr natively signal failure for no-label / no-title results.

• FileSystemFactory.ScopeCurrentWorkingDirectory: filter ancestor extension roots in addition to descendants. An ancestor would subsume the working root and produce overlapping scope roots, causing ScopedFileSystem to throw ArgumentException — the same class of crash fixed in a96ef86 / 3c5f970 for Codex nested paths.
• FileSystemFactory.RealReadForRunnerTemp: fix docstring that incorrectly claimed the fallback triggers when "not in CI" (nothing consulted IsRunningOnCI).
• ChangelogCommand: catch SecurityException alongside IOException when reading --prs / --issues from a file. ScopedFileSystemException extends SecurityException, so an out-of-scope path escaped as an unhandled exception.
• ChangelogPrEvaluationService.EvaluatePr: emit collector.EmitError(...) + return false for NoTitle and NoLabel (type and product) results. ServiceInvoker already translates collector.Errors > 0 → exit code 1, so docs-builder now fails natively without a separate bash Gate step. GitHub Actions outputs (status, label-table, etc.) are still written before the process exits, so downstream steps with if: always() can still read them.

The companion docs-actions PR is elastic/docs-actions#257.

Tests

• FileSystemFactoryTests: RealReadForRunnerTemp (unset → falls back to RealRead, sibling RUNNER_TEMP allows staged file read), ScopeCurrentWorkingDirectory ancestor root guard.
• ChangelogPrBodyReaderTests: outside-scope emits Warning, missing file emits Warning.
• ChangelogPrEvaluationServiceTests: TDD gate tests — NoTitle, NoTypeLabel, NoProductLabel each emit a Severity.Error diagnostic and return false; success emits no diagnostics. All existing no-label / no-title tests updated from BeTrue() to BeFalse().

Test plan

• ./build.sh unit-test green
• evaluate-pr on a PR with no changelog label → exit code 1, ::error:: annotation visible in Actions UI
• evaluate-pr on a PR with a valid changelog label → exit code 0, ::notice::proceed

🤖 Generated with Claude Code