fix(cli): harden 2.5 canary validation

[bntvllnt]

Summary

• bump package base to 2.5.0 for main-branch canary publishing only; no stable release/tag
• fix CLI target-root handling, exact path lookup, parent .gitignore parsing, --force propagation
• reject invalid enum-like CLI options for hotspots --metric, changes --scope, check --gate
• document full CLI/MCP surface and make pnpm test rebuild dist with stable Vitest runner flags

Verification

• pnpm lint
• pnpm typecheck
• pnpm build
• pnpm test
• real dist CLI smoke: 53/53 across this repo, create-vllnt-app/cli, create-vllnt-app/www, temp init repo

Release

• Canary mode only. Merging to main publishes 2.5.0-canary. via the existing publish workflow.
• Do not run the manual release workflow for stable 2.5.0 from this PR.