Can we analyze the blocks or the data sent per block in order to see if it includes new data that we do not recognize and assume that's a soft fork and invalidate such a block? Can a softforked mining node send data that a user's fullnode can't tell it's foreign?
Because a soft fork by definition follows stricter rules than the normal chain, you would have to make assumptions based on the block data. For example, if a soft fork no longer allows certain scripts, you might be able to determine that by noticing that those scripts are no longer present in any blocks from that miner. However, it would be a guess since it is still a valid block, and just might happen to not contain those scripts.
There might be other changes that would be more obvious, but still a guess because the blocks will remain valid according to consensus rules.
A witness root hash is calculated with all those wtxid as leaves, in a way similar to the hashMerkleRoot in the block header.
The commitment is recorded in a scriptPubKey of the coinbase transaction.
However, without knowing what to expect (and without the witness data, which was not sent to old nodes), this data is meaningless. One thing that does give away data that may appear to be extraneous is the use of the
OP_RETURN script code, since this allows arbitrary data to be included in a transaction, and this is used in the commitment structure.
It is also interesting to see how BIP141 handled older nodes, by simply not sending witness data, see Backwards Compatibility. The segwit transactions appear to be anyone-can-spend scripts to older nodes, so the only thing they lose out on is the ability to validate segregated witness transactions, since it will assume such transactions are always valid. They don't know about or propagate witness data.