getVersionSpecificBestPractices() resolves an npm package (and reads a
file path declared in that package's package.json) starting from a
caller-supplied workspacePath, without checking it against the client's
declared MCP roots. Every other workspace-path-consuming MCP tool
(run_target, devserver_start/stop/wait_for_build) validates this through
resolveWorkspaceAndProject()'s isAllowedWorkspacePath() check; this tool
never did.

Export isAllowedWorkspacePath() from workspace-utils.ts and call it in
getVersionSpecificBestPractices() before resolving anything, falling back
to the bundled guide when the path is outside the allowed roots, matching
this file's existing fallback behavior for every other failure case.

…practices tool

isAllowedWorkspacePath can throw if the workspace path does not exist
(realpathSync) or if listRoots() fails against the connected client.
Wrap the check in a try-catch and fall back to the bundled guide on
any failure, matching this function's existing fallback behavior.

…tool

Aligns get_best_practices with resolveWorkspaceAndProject, which throws
when a caller-supplied workspacePath falls outside the client's declared
MCP roots rather than silently falling back. The try/catch now wraps only
the isAllowedWorkspacePath call so genuine verification failures (e.g. a
non-existent path) still fall back to the bundled guide, while a path
outside the roots surfaces an actionable error pointing at list_projects.