Infrastructure convenience: walk roots, read each file, then delegate to
run_on. Only files claimed by at least one validator are read; binary
and unrecognised files are silently skipped. Read errors on claimed files
are surfaced as Diagnostic::error entries rather than panicking.