Fail closed on unreadable inputs, empty batches and failed strips

The metadata scanners read raw bytes, so random bytes, an empty file or a
truncated PNG or MP4 printed the same "No AI metadata found" or "AI metadata
stripped" a real file gets, with exit 0. `metadata.unreadable_reason` is now
the one readability probe: `identify`, `metadata` and every `video` command
exit 1 on such input, and `batch` and `video batch` fail its row.
`strip_and_verify` refuses it before writing anything.

A `batch` or `video batch` directory with no supported file exits 2 and
creates no output directory. `visible` and `erase` strip and verify on a
staged sibling and publish nothing when a marker survives, as the library
`remove_visible` now does; the diffusion writer raises on a surviving
marker. An invisible engine that cannot start exits 1 without a traceback,
and the MCP server reports a child that could not start.

NotebookLM and Gemini slide-deck templates are recorded as not planned.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -705,8 +705,9 @@ the tool contract are in the [MCP server guide](mcp-server.md).
 
 The CLI uses nonzero exit codes for meaningful incomplete outcomes, including
 no detected target on commands that would otherwise regenerate or create a
-misleading unchanged result, processing errors, and a required invisible step
-that could not run.
+misleading unchanged result, a batch directory with nothing to process,
+processing errors, an input that is not a readable image or video, and a
+required invisible step that could not run.
 
 Scripts should check the process exit code and the output path. The detailed
 per-command contract is maintained in