Fix scan I/O safety and incomplete-scan exit status

[script3r]

A nonexistent scan root previously returned exit code 0, and passing the input as --output truncated the source before discovery. Concurrent edits could also invalidate the file-backed memory map.

This change reports discovery/read/parse failures through the exit status, uses bounded owned reads, and stages file output beside its destination until all scanning and writing succeeds. Existing source files, explicit inputs, custom pattern files, and symlink destinations are protected. Writer errors cancel discovery and scanning; redirected stdout is excluded from discovery.

Behavior change: --output requires a writable destination directory and a regular-file destination. Stdout can still contain partial findings when a scan fails. Staged replacement protects against failed scans, but does not promise crash durability or a filesystem-wide snapshot during concurrent source edits.

Evidence: reproduced missing-root success and source truncation on a659f1c; memmap2's safety contract explicitly identifies concurrent modification as a potential source of undefined behavior.

Validation: cargo fmt --all -- --check; Clippy with warnings denied for all targets under both all features and no default features; all-feature and minimal-feature test suites. Added regression coverage for input preservation, invalid options, partial stdout, symlink output, read bounds, and flush failures. Existing patterns and fixture files are unchanged.

Part 1 of a review series; independently based on main.