fix(cli): fail closed when --isolate-app cannot be honored

[yeongseon]

Context

--isolate-app currently fails open: when --app module (no variable) or no --app is given, the CLI only warns (or is silent) and falls back to the global registry while still returning rc==0. A user who explicitly asked for isolation gets a non-isolated spec with a success exit code — a silent correctness/security footgun. See cli.py handle_generate (isolate at L205, fallback L220-244).

Proposed semantics

• --isolate-app + (no --app | --app module without variable) -> exit 1 with a clear error.
• --app module:variable -> isolate as today.
• No --isolate-app flag -> unchanged behavior.

Acceptance Checklist

• --isolate-app without a resolvable app variable exits non-zero
• Error message states why isolation could not be honored
• Existing tests asserting rc==0 for the module-only fallback are updated
• Regression test covering the fail-closed path

References

• refactor: opt-in app-scoped registry isolation (#381) #388, fix(bridge): make isolated re-scan idempotent by seeding on function id #390