fix(simulation): scope worker git ownership checks

simulation/s0/build_evidence_manifest.py

@@ -90,7 +90,17 @@ def _package_version(package: str) -> str:
 
 
 def _git_commit(path: Path) -> str:
-    commit = _run(["git", "-C", str(path), "rev-parse", "HEAD"])
+    commit = _run(
+        [
+            "git",
+            "-c",
+            f"safe.directory={path}",
+            "-C",
+            str(path),
+            "rev-parse",
+            "HEAD",
+        ]
+    )
     if re.fullmatch(r"[a-f0-9]{40}", commit) is None:
         raise EvidenceError(f"invalid Git commit at {path}: {commit!r}")
     return commit