fix(gates): refuse a configured ROOT that does not exist in check-role-word (#10308)

`walk()` ran behind `existsSync(root)`, so a directory named in ROOTS but
absent from the tree was skipped and the gate reached a verdict — including
OK — over whatever the surviving roots contributed. #9910 made that legible
(the per-root `Scanned:` line) and deliberately stopped short of refusing,
because refusing is a verdict change. This takes that change.

Measured on the parent commit, all three exit 0:

  * no root present (reachable with no source edit, by running the gate from
    any directory that is not the repo root): `OK, no new occurrences` over a
    zero-file scan, with the cwd-relative ledger reading `{}` so nothing
    contradicted the green;
  * one root missing with the ledger fully populated: named in the Scanned
    line with its zero, still OK — the card's headline case, which the
    ratchet-DOWN branch never protected because a root whose ledger share is
    already zero takes nothing with it when it goes;
  * `--update` with no root present: overwrote a populated ledger with `{}`
    and exited 0.

Per-root rather than the suggested "refuse only when EVERY root is missing".
That middle route's whole justification is keeping the gate runnable in a
partial checkout, and no such caller exists: the gate has two executing
callers (the root `check:role-word` script and the `Lint & Repo Gates` step
that runs it), that job checks out with no `sparse-checkout` filter, nothing
in the repo configures one, `fetch-depth: 0` and the `--depth` clones
elsewhere truncate history rather than the working tree, and both roots are
tracked directories. The middle route would protect nobody while leaving the
headline case green.

A healthy tree's verdict and output are byte-identical. A root that EXISTS
and contributes nothing stays green — that is the zero-volume Scanned line's
subject, and it is what the per-root #9910 assertions now test.

The self-test pins the shape in two layers: pure legs prove the probe
discriminates (including the partial tree, the leg the middle route fails),
and spawned legs run the gate inside built trees so a probe nothing calls
cannot pass. The `--update` leg asserts the ledger is byte-identical
afterwards, not merely that the exit code is 1.

Fixes #9932


Claude-Session: https://claude.ai/code/session_01DdCnBGcHeufjrq7drTD3wt

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang