Register the workspace as a git safe.directory in container jobs

Every container job (distros, alpine) failed at the anchor-recording
step with "fatal: detected dubious ownership in repository": run steps
in containers execute with a different HOME than the checkout action,
so the safe.directory entry checkout registers isn't visible to git
invoked from our scripts. Register it ourselves in both the anchor
script and the cache action's restore step (without it, the restore
would silently treat the anchor as unresolvable and containers would
never get warm builds).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013MTT3EVJrxAz3oJZhh6rhE