Test the -x filesystem-boundary rejection branch (closes #17)

No test ever ran the part of subdirJob that refuses to descend across
a filesystem boundary under -x. The new tests call subdirJob directly
with a made-up device for the operand, so no second real filesystem is
needed. They cover refusal across a boundary, skipping the check when
the operand's device is unknown, the warning when the subdirectory
cannot be statted, and crossing by default without -x. scan.go is
unchanged.

Model: opus-4-8 (implementation); opus-5-5 (rework)

TODO.md

@@ -29,6 +29,9 @@
 
 # Completed Steps
 
+- test the `-x` filesystem-boundary rules in `subdirJob` (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/17)
+
 - the `Dockerfile` build stage keeps the Go module cache out of `builder`'s
   home and copies the sources with `--chown`, so no `chown -R` walks them
   (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/43)