fix(cli): reject invalid scan roots

[be-student]

Closes #82

What & why

diskern scan previously accepted no roots and silently treated a nonexistent root as a successful empty scan. That made a path typo indistinguishable from a genuinely empty result, especially in JSON automation.

This makes clap require at least one root and validates each root before calling the scanner. Descendant walk errors remain recoverable inside the scanner; only invalid entry roots fail at the CLI boundary. Both failures now return nonzero exits with actionable messages.

Validation

• cargo fmt --all --check
• cargo clippy -p diskern-core -p diskern-cli --all-targets -- -D warnings
• cargo test -p diskern-core -p diskern-cli (59 passed)
• manual no-root invocation exits 2 with usage
• manual nonexistent-root invocation exits 1 and names the path

Checklist

• Formatting, scoped clippy, and scoped tests are clean
• Commit is small and focused
• Does not weaken a safety principle
• User-visible behavior is documented under Unreleased

[Muawiya-contact]

Thanks @be-student!
I’ve had a look at the implementation, and the approach matches the issue well. I’ll review the PR and validation results in detail. Appreciate you taking this on and keeping the change focused! 🚀

[Muawiya-contact]

Welcome, and thanks for this! 🙌

The fix is right and the tests cover both cases. Two things before it can go in:

• Needs a rebase. #78 touched the same parts of main.rs after you opened this.
• After rebasing, move your changelog line up to [Unreleased]. We shipped v0.2.0 today, so it currently lands inside the released section and git won't warn you.

One optional idea: try_exists() instead of exists(), so an unreadable root doesn't report as missing.

Ping me when it's rebased.

[be-student]

Rebased via a merge with current main and moved the changelog entry to Unreleased. I also adopted try_exists() so an unreadable root is not misreported as missing. cargo test -p diskern-cli passes.

[Muawiya-contact]

Rebase and changelog both sorted, and thanks for taking the try_exists idea. Ran it here: fmt, clippy and all tests pass.

One last thing, and it's a one-liner. try_exists()? propagates the raw io error, so the path drops out of the message:

$ diskern scan /nope
Error: scan root does not exist: /nope

$ diskern scan /etc/hosts/inner
Error: Not a directory (os error 20)

The second one doesn't say which root, or that it's about a root at all. With several roots on the command line you can't tell which one failed. A .with_context(|| format!("could not check scan root '{}'", root.display()))? gets it back.

Then this is good to go.