fix(ck-cli): don't reduce the search root past the operands' shared parent

[ak2k]

The bug

ck <query> docs/ notes.md — a directory operand plus a file beside it — roots the walk at / and traverses the whole filesystem. On current main:

mkdir -p /tmp/ckdemo/docs && cd /tmp/ckdemo
echo needle > docs/a.txt; echo needle > notes.md
ck needle docs notes.md      # hangs — walking /
ck needle notes.md docs      # instant (order-dependent)

Where / isn't writable it surfaces as Read-only file system (os error 30) instead — ck trying to index /. I found it after a ck process spent 4.5h walking a mounted cloud drive, downloading files as it went.

Cause

In find_search_root(), when the candidate is an ancestor of the current root, the second loop walks the candidate up looking for an ancestor contained by the (deeper) root — a condition that never holds, so it runs to /, which the trailing if root.starts_with(&candidate) then adopts.

Fix

Reduce to the operands' longest common path prefix instead of walking either path up one parent at a time. Both containment fast-paths are kept as short-circuits.

Scope

This makes the root the operands' actual shared parent; it doesn't bound how wide that parent may legitimately be. ck <query> /tmp/a /var/b still roots at /, because / genuinely is their shared parent — unchanged here, and pinned by a test. If you'd want disjoint operands handled differently (per-operand walks, or an error), that's a separate behavioral decision.

Verification

Six unit tests, including both operand orders and order-independence for N>2. Differential-tested against the old walk over 500k random operand sets: narrower in some, broader in none. cargo test (91), clippy, fmt clean. CHANGELOG + UNEXPECTED.md entries included.

Two things worth your call

• Operands sharing no component (relative a/x + b/y, or differing Windows drives) reduce to nothing. I keep the current root so one operand is still covered, rather than the old fall-through to . which covered neither. The dropped operand is silent — happy to add a warning if you'd prefer.
• The containment fast-paths are strictly redundant with the reduction (verified exhaustively). Kept as an optimization; happy to collapse the loop body if you'd rather have the smaller code.