refactor render prep, numeric parsing, and sensitive screening

[hyle]

Summary

Refactor three growing areas of the codebase to keep fuori maintainable without changing its behavior.

Changes

• Unify numeric option parsing in options.c behind a single size-value parser with configurable minimums
• Move sensitive filename/content screening out of collect.c into a dedicated sensitive.c / sensitive.h module
• Split render-plan preparation into smaller helpers so hunk-aware rendering logic is easier to follow and maintain
• Update the build to compile the new sensitive-screening module
• Keep existing CLI behavior and regression coverage intact

Why

These changes reduce duplication, clarify ownership boundaries, and make the most complex code paths easier to reason about:

• option parsing no longer has two near-duplicate integer parsers
• file collection no longer mixes filesystem walking with secret-detection details
• render prep no longer concentrates all hunk classification and range-building logic in one large function

Verification

• Ran make test successfully
• Manual auditing of some output samples