collectFiles follows symlinks with no cycle detection

[royalpinto007]

Problem

collectFiles follows symlinks with no visited-set: a symlink to an ancestor recurses forever, a symlink to /etc pulls outside files into the scan.

Where

src/scan.js (statSync follows symlinks, walk recurses with no cycle detection).

Acceptance

Add a failing test first with a cyclic-symlink fixture asserting collectFiles terminates and stays within the target. Then fix.