fix(reference)!: preserve symlink races and root failure facts

Classify replacement EINVAL at the readlink syscall so the reader and importer
retain sibling observations. Give an admitted root's enumeration failure its
own typed field, use it for unresolved symlink coverage, and project it as a
graph limitation instead of an invalid dot-path child entry. Keep admission,
cancellation and cleanup failures distinct.

Closes #5135
Closes #5136

BREAKING CHANGE: Partial reference-source reader results report failed root
enumeration in rootFailure instead of a failed directory child at path ".".
Historical source graphs preserve the root failure as a top-level limitation.

docs/cli.md

@@ -286,6 +286,12 @@ reported separately as configured-secret exclusions.
 Re-import saved graphs whose pattern-based exclusions lack `pattern` before
 using them in source-to-bundle comparisons.
 
+Entries that change during an import retain an unavailable-entry diagnostic
+alongside readable siblings. If enumeration of an already admitted root fails,
+the graph keeps its observed children and records the root failure as a
+top-level limitation. That partial inventory does not establish absence among
+unexamined children.
+
 JavaScript and TypeScript import parsing requires valid UTF-8. Malformed source
 bytes retain their original hashes and sizes with a decoding diagnostic; REA
 does not infer module targets from replacement characters.