Add bounded concurrent scanner

Single-writer controller with a select loop that offers jobs and accepts
results simultaneously, so bounded channels cannot deadlock. statx/fstatat
relative to the directory fd on Linux/macOS, portable fallback elsewhere.
Hard links counted once, symlink loops detected, virtual filesystems
skipped, errors classified and surfaced.

internal/platform/mode_unix.go

@@ -0,0 +1,36 @@
+//go:build unix
+
+package platform
+
+import (
+	"io/fs"
+	"syscall"
+)
+
+func modeFromUnix(m uint32) fs.FileMode {
+	mode := fs.FileMode(m & 0o777)
+	switch m & syscall.S_IFMT {
+	case syscall.S_IFDIR:
+		mode |= fs.ModeDir
+	case syscall.S_IFLNK:
+		mode |= fs.ModeSymlink
+	case syscall.S_IFIFO:
+		mode |= fs.ModeNamedPipe
+	case syscall.S_IFSOCK:
+		mode |= fs.ModeSocket
+	case syscall.S_IFCHR:
+		mode |= fs.ModeDevice | fs.ModeCharDevice
+	case syscall.S_IFBLK:
+		mode |= fs.ModeDevice
+	}
+	if m&syscall.S_ISUID != 0 {
+		mode |= fs.ModeSetuid
+	}
+	if m&syscall.S_ISGID != 0 {
+		mode |= fs.ModeSetgid
+	}
+	if m&syscall.S_ISVTX != 0 {
+		mode |= fs.ModeSticky
+	}
+	return mode
+}