fix(validator): run buf lint/breaking from module root with --path

[daniel-garcia]

What

apx release finalize re-validates the schema with buf lint / buf breaking, invoking buf with
the API subdirectory as a positional build input:

exec.Command(bufPath, "lint", absPath)                              // internal/validator/proto.go
exec.Command(bufPath, "breaking", absPath, "--against", againstArg)

For any canonical repo whose protos live under a buf v2 module (module_roots: [proto]), buf
rejects this:

Failure: failed to build input "proto/<domain>/<name>/v1" because it is contained by module at
path "proto" specified in your configuration, you must provide the workspace or module as the
input, and filter to this path using --path

This makes finalize fail at re-validation for every proto-module repo, so a versioned release
tag can never be cut. (apx lint with no args is unaffected because it lints the whole module.)

Fix

ProtoValidator.Lint/Breaking now resolve the buf workspace/module root (nearest ancestor with
buf.work.yaml/buf.yaml), run buf from that root, and select the target via --path:

buf lint --path proto/<domain>/<name>/v1
buf breaking --against <ref> --path proto/<domain>/<name>/v1

This is the buf-blessed invocation (verified: the equivalent command exits 0 on a real canonical
repo where the old form fails). When the schema dir is itself the module root, --path is omitted.

A bufRootAndPath helper does the root detection; added TestBufRootAndPath (pure filesystem,
no buf needed). go build ./... and go test ./internal/validator/... pass.

Context

This is finding #1 of #5. That issue also tracks three related release-pipeline
gaps (finalize unwired in canonical CI; tag …/v1/vX vs go-module …/<name> mismatch;
apx auth login not persisting a usable token) which are out of scope for this PR.

Closes #5 partially (finding #1).