fix(tests): the composition perf test scans its own tree, not pytest's shared temp root

[fas89]

Why

test_for_contract_perf_bound_shallow_path failed the Coverage & Audit run on main after the 0.18.0 PRs merged. The composition scan took 10.50 s against a 10 s bound.

The test placed its workspace directly in tmp_path, which is a shallow path with no boundary marker. The ancestor walk therefore took tmp_path's parents as scan roots. Those are pytest's per-worker and per-session temp roots, which hold every *.fluid.yaml written by every earlier test. The scan time grew with the suite, and #687, #688 and #689 added many contract-writing tests. The product code is unchanged: the scan parses with load_yaml_safe only, and product_types.py was not touched by those PRs.

What

The workspace now sits _MAX_ANCESTOR_LEVELS below tmp_path. The capped walk still crosses marker-less ancestors up to the cap, which is what the test is for, but it ends at tmp_path. The test asserts this through _resolve_scan_roots.

Tested

• tests/test_composition_workspace_scan.py: 22 passed. The perf test takes about 1 s.
• Negative control: with the old placement, the new assertion fails, and the scan takes 19 s locally on a well-used temp tree.
• ruff passes, and black==24.10.0 --check passes.

Documentation

• No docs needed: test-only change.

[github-actions]

📄 Documentation Reminder

This PR appears to be missing a documentation reference. Our docs live in a separate repo.

Please update the PR description with one of:

• Link a docs PR — check the "Docs PR linked" box and paste the URL
• Mark as no docs needed — check "No docs needed" with a justification
• Acknowledge docs TODO — check "Docs TODO" and create the docs PR before merge

See the Contributing Guide for details.