Exclude non-app paths from bench validation

Bench app validation now ignores `scripts/`, `clients/`, `services/`, `metal/` and keeps `atlas/vm/scripts/` ignored for cloud-init.