Skip excluded paths before looking at their errors (closes #16)

filepath.Walk hands its callback the error for a path it could not
read, such as a directory it cannot list. Both callbacks, in
walkAndProcess and countFiles, returned that error before they checked
the exclusions, so a directory that --exclude or --exclude-dotfiles
excluded still failed the run when it could not be listed. Given an
error, each callback now checks the exclusions first and skips an
excluded path. The new test excludes a directory that cannot be listed
and runs sum add and check over its parent.

Model: opus-5-5

TODO.md

@@ -25,6 +25,9 @@ today), `.dockerignore`, `.gitea/workflows/check.yml` and
 
 # Completed Steps
 
+* 2026-10-06: a path that `--exclude` or `--exclude-dotfiles` excludes
+    is skipped even when it cannot be read, so an excluded directory
+    that cannot be listed no longer fails the run
 * 2026-10-06: lint and test run as phases of the `Dockerfile`, and the
     build stage depends on both; `script/lint` and `script/test` each
     build their phase with `--no-cache`; `script/cibuild` bootstraps,