… findings

All 26 SpotBugs NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE findings shared
the same shape: calling `.toString()` on `Path.getFileName()` (or once
on `Path.getParent()`) where the result can legitimately be null for
root-like paths (e.g. `/`, a bare filename with no parent).

Uniform fix: wrap every `path.getFileName().toString()` with
`java.util.Objects.toString(path.getFileName(), fallback)`, choosing a
sensible per-site fallback:
  - `""` where the string is then substring-matched against a known
    set (filenames, extensions, excluded-dir names); empty never
    matches those sets, preserving existing semantics.
  - `"unknown"` for human-facing project names in TopologyCommand,
    EnrichCommand service detection, StatsCommand output header.
  - `"bundle"` for BundleCommand's project-name derivation.
  - `"flow"` for FlowCommand's html project name.
  - `PROP_ROOT` (existing constant) in Analyzer.

One non-`getFileName` case: AnalysisCache's constructor called
`Files.createDirectories(dbPath.getParent())` unconditionally; rewrote
as a null-guarded block so a bare-filename dbPath (no directory
component) doesn't NPE.

Files touched (12):
  analyzer/Analyzer.java          (5 edits — incl. 1 replace_all
                                   that covered 3 triplicated blocks
                                   in analyzeFileWithRegistry /
                                   analyzeFile / createInventoryNode)
  analyzer/ConfigScanner.java     (1)
  analyzer/FileClassifier.java    (1)
  analyzer/FileDiscovery.java     (2)
  analyzer/ServiceDetector.java   (3)
  cache/AnalysisCache.java        (1 — getParent null-guard)
  cli/BundleCommand.java          (1)
  cli/EnrichCommand.java          (2)
  cli/FlowCommand.java            (1)
  cli/PluginsCommand.java         (2)
  cli/StatsCommand.java           (1)
  cli/TopologyCommand.java        (1)

Verified:
  - `mvn compile` clean.
  - `mvn spotbugs:spotbugs` re-run: NP_NULL count 26 -> 0.
  - `mvn test` (full suite): 3,059 tests, 0 failures, 0 errors.

No behavior change for the common case: for any non-root path,
`path.getFileName() != null` and Objects.toString returns the same
value as the old `.toString()`. The fallback string is only observed
if callers hand in a root-like path — previously an NPE, now a safe
sentinel that flows through existing logic.