reset: disallow "reset --keep" outside a work tree