fix(reference)!: preserve symlink races and root failure facts

Classify replacement EINVAL at the readlink syscall so the reader and importer
retain sibling observations. Give an admitted root's enumeration failure its
own typed field, use it for unresolved symlink coverage, and project it as a
graph limitation instead of an invalid dot-path child entry. Keep admission,
cancellation and cleanup failures distinct.

Closes #5135
Closes #5136

BREAKING CHANGE: Partial reference-source reader results report failed root
enumeration in rootFailure instead of a failed directory child at path ".".
Historical source graphs preserve the root failure as a top-level limitation.

src/reference/ReferenceSourceReaderTypes.ts

@@ -61,8 +61,15 @@ export type ReferenceSourceEntry =
       readonly size?: number;
     };
 
+/** A failure enumerating an already admitted root, separate from its children. */
+export interface ReferenceSourceRootFailure {
+  readonly code: ReferenceSourceFailureCode;
+  readonly message: string;
+}
+
 export interface ReferenceSourceRead {
   readonly root: string;
+  readonly rootFailure?: ReferenceSourceRootFailure;
   readonly entries: readonly ReferenceSourceEntry[];
   readonly bytesRead: number;
   /** Node exposes no portable openat traversal; pathname identity is checked around each operation. */
@@ -98,6 +105,7 @@ export type TraversalState = {
     readonly kind: ReferenceSourceExclusionKind;
   }>;
   readonly pending: PendingDirectory[];
+  rootFailure?: ReferenceSourceRootFailure;
   bytesRead: number;
 };