fix(cli): reject invalid scan roots

[be-student]

Closes #82

What & why

diskern scan previously accepted no roots and silently treated a nonexistent root as a successful empty scan. That made a path typo indistinguishable from a genuinely empty result, especially in JSON automation.

This makes clap require at least one root and validates each root before calling the scanner. Descendant walk errors remain recoverable inside the scanner; only invalid entry roots fail at the CLI boundary. Both failures now return nonzero exits with actionable messages.

Validation

• cargo fmt --all --check
• cargo clippy -p diskern-core -p diskern-cli --all-targets -- -D warnings
• cargo test -p diskern-core -p diskern-cli (59 passed)
• manual no-root invocation exits 2 with usage
• manual nonexistent-root invocation exits 1 and names the path

Checklist

• Formatting, scoped clippy, and scoped tests are clean
• Commit is small and focused
• Does not weaken a safety principle
• User-visible behavior is documented under Unreleased

[Muawiya-contact]

Thanks @be-student!
I’ve had a look at the implementation, and the approach matches the issue well. I’ll review the PR and validation results in detail. Appreciate you taking this on and keeping the change focused! 🚀