Reject empty values passed to --dep-root

## Current evidence

`src/cli.rs` rejects an empty value in the `--dep-root=` form, but the separate `--dep-root ` branch pushes the following argument directly into `g.dep.roots` without checking whether it is empty or whitespace-only.

The two spellings of the same option therefore have different validation behavior.

## Scope

- Apply the same non-empty validation to both `--dep-root=` and `--dep-root `.
- Treat whitespace-only values as missing values.
- Preserve valid relative and absolute dependency-root paths.
- Do not add filesystem-existence requirements to this task.

## Completion criteria

- CLI tests cover empty and whitespace-only values for both option spellings.
- Valid values continue to populate dependency roots unchanged.
- Invalid values use the existing CLI usage-error path and message style.

Start in src/cli.rs and inspect the separate-argument branch alongside the existing --dep-root= validation. Run the existing CLI tests, then add coverage for empty and whitespace-only values in both spellings while checking that valid relative and absolute paths remain unchanged and invalid inputs use the existing usage-error style.

Written by the indexing model from the issue text.