fix(reference): distinguish root access failures from invalid input

Share root filesystem failure classification between import preflight and traversal. Missing roots remain invalid selections; permission and I/O errors retain their reason and reach the CLI as execution failures. Preserve cancellation priority and expose unexpected exceptions.

Validation: compiled CLI permission regression, direct reader error details, import/traversal and unreadable-directory boundaries passed. Windows-only cases were skipped on macOS; static, architecture and documentation checks passed.

src/reference/ReferenceSourceReaderValidate.ts

@@ -7,6 +7,7 @@ import {
   cancelled,
   failure,
   filesystemFailureDetail,
+  rootFilesystemFailure,
 } from "./ReferenceSourceReaderErrors.js";
 import { isPathWithinRoot } from "../domain/localPath.js";
 import {
@@ -120,11 +121,11 @@ export const prepareRoot = async (
     return ok({ canonicalRoot, rootIdentity: canonicalMetadata });
   } catch (cause: unknown) {
     if (isAborted(signal)) return err(cancelled());
-    const message = filesystemFailureDetail(
+    const rootFailure = rootFilesystemFailure(
       cause,
       "Reference source root could not be resolved",
     );
-    if (message === undefined) throw cause;
-    return err(failure("invalid-root", `${message}: ${root}`));
+    if (rootFailure === undefined) throw cause;
+    return err(failure(rootFailure.code, `${rootFailure.message}: ${root}`));
   }
 };