fix(@angular/cli): throw on out-of-roots workspace in best-practices tool

Aligns get_best_practices with resolveWorkspaceAndProject, which throws
when a caller-supplied workspacePath falls outside the client's declared
MCP roots rather than silently falling back. The try/catch now wraps only
the isAllowedWorkspacePath call so genuine verification failures (e.g. a
non-existent path) still fall back to the bundled guide, while a path
outside the roots surfaces an actionable error pointing at list_projects.

Author: herdiyana256

packages/angular/cli/src/commands/mcp/tools/best-practices.ts

@@ -97,15 +97,9 @@ async function getVersionSpecificBestPractices(
   server: McpToolContext['server'],
 ): Promise<{ content: string; source: string } | undefined> {
   if (server) {
+    let isAllowed: boolean;
     try {
-      if (!(await isAllowedWorkspacePath(server, workspacePath))) {
-        logger.warn(
-          `Workspace path is outside the allowed MCP roots: ${workspacePath}. ` +
-            'Falling back to the bundled guide.',
-        );
-
-        return undefined;
-      }
+      isAllowed = await isAllowedWorkspacePath(server, workspacePath);
     } catch (e) {
       logger.warn(
         `Failed to verify workspace path '${workspacePath}': ` +
@@ -114,6 +108,13 @@ async function getVersionSpecificBestPractices(
 
       return undefined;
     }
+
+    if (!isAllowed) {
+      throw new Error(
+        `Workspace path is outside the allowed MCP roots: ${workspacePath}. ` +
+          "You can use 'list_projects' to find available workspaces.",
+      );
+    }
   }
 
   // 1. Resolve the path to package.json