Git ceiling: a separator in the store's parent path defeats "no parent repository" #2076

From the CodeRabbit deep scan (finding #3, low), left out of #2075.

Problem

With "use a parent repository" off, QtPass sets GIT_CEILING_DIRECTORIES to the store's parent folder (Util::gitCeiling(), used by Pass::updateEnv() and ProfileInit). Git splits that variable on : (POSIX) or ; (Windows). A parent path that holds the separator, for example /home/me/a:b/store, becomes two entries, neither of which is the parent. Git then walks above the store and can find, add to, commit to and push a repository the store merely lies in (a dotfiles repository in the home folder).

Such paths are rare, but the setting promises isolation and silently does not give it.

Options

1. Detect the separator in gitCeiling() and refuse git operations (with a message) when parent-repository use is off and the store has no .git of its own.
2. Before a mutating git call, check git rev-parse --show-toplevel equals the store, and refuse otherwise. This also covers any other way the ceiling could fail.
3. Set GIT_DIR/GIT_WORK_TREE to the store's own repository when it has one. Needs care: .git may be a gitfile (worktree, submodule).

Option 2 reads as the most robust. A regression test with a : in the parent path (POSIX only) belongs with it.