fix(evidence): support nested workspace roots

harness/tht/cli/evidence_cmd.py

@@ -23,9 +23,10 @@ evidence_app = typer.Typer(help="Prepare and validate workspace Evidence", no_ar
 
 
 def _canonical_worktree(workspace_root: Path) -> Path:
-    if workspace_root.is_symlink():
-        raise typer.BadParameter("workspace-root must not be a symlink")
+    requested = workspace_root.absolute()
     root = workspace_root.resolve()
+    if workspace_root.is_symlink() or requested != root:
+        raise typer.BadParameter("workspace-root must not be a symlink")
     result = subprocess.run(
         ["git", "rev-parse", "--show-toplevel"],
         cwd=root,
@@ -33,8 +34,15 @@ def _canonical_worktree(workspace_root: Path) -> Path:
         capture_output=True,
         text=True,
     )
-    if result.returncode != 0 or Path(result.stdout.strip()).resolve() != root:
-        raise typer.BadParameter("workspace-root must be the root of a canonical Git worktree")
+    if result.returncode != 0:
+        raise typer.BadParameter("workspace-root must be inside a canonical Git worktree")
+    git_root = Path(result.stdout.strip()).resolve()
+    try:
+        root.relative_to(git_root)
+    except ValueError as error:
+        raise typer.BadParameter(
+            "workspace-root must be inside a canonical Git worktree",
+        ) from error
     return root