Resolve scan operands to their real paths (closes #144)

scan now resolves each operand to its real path, every symlink followed, before the walk, as sneak ruled. Files are recorded and warnings printed under that path. With /srv/link a symlink to a directory outside /srv, scan /srv /srv/link/sub now walks sub on its own and keeps its records, where before it dropped sub and deleted them. A symlink operand is scanned at its target. A dangling symlink is a fatal error, exit 1. A .. after a symlink counts from the symlink's target, as realpath does. The .zfs rule applies to the real path. The walk still follows no symlink it finds.

Judgement call: records an earlier scan stored under a path through a symlink are not migrated; there is no installed base.

Model: opus-5-5

TODO.md

@@ -29,6 +29,12 @@
 Newest first. An entry ends with its date and its issue or branch, where those
 are known.
 
+- `scan` resolves each operand to its real path, symlinks followed, before the
+  walk. A symlink operand is scanned at its target instead of skipped. With
+  `/srv/link` a symlink to a directory outside `/srv`, `scan /srv /srv/link/sub`
+  walks `sub` on its own instead of dropping it and deleting its records
+  (2026-11-06, https://git.eeqj.de/sneak/sfdupes/issues/144)
+
 - `README.md` and a comment in `scan.go` no longer say ZFS counts a new file's
   blocks only seconds after the write. The count can land in under a second.
   Both now say up to seconds after the write, as the comment on `diskSizeOf` in