fix: nightly hardening - loader root validation

[mouse-value-add]

problem

Golden-set loaders accepted non-object roots (for example JSON arrays or YAML sequences). Those payloads fail later with less actionable schema errors and make malformed test fixtures harder to debug.

approach

• Added explicit root-type validation in both loaders before Pydantic parsing:
  • JSONLoader now requires a JSON object root.
  • YAMLLoader now requires a YAML mapping root.
• Added regression tests in tests/test_loader_root_validation.py to lock behavior.

verification

• python3 -m pytest tests/test_loader_root_validation.py tests/test_cli_hardening.py tests/test_http_provider_response_parsing.py
• New tests pass and existing targeted hardening tests still pass.

risks

• Inputs that previously produced deeper schema errors now fail earlier with clearer validation messages.
• No runtime behavior change for valid golden sets.

rollback plan

• Revert this PR to restore previous permissive loader behavior.
• If needed, remove only one loader check and keep the other.