Resolve scan operands to their real paths (closes #144)

scan now resolves each operand to its real path, every symlink followed, before the walk, as sneak ruled. Files are recorded and warnings printed under that path. With /srv/link a symlink to a directory outside /srv, scan /srv /srv/link/sub now walks sub on its own and keeps its records, where before it dropped sub and deleted them. A symlink operand is scanned at its target. A dangling symlink is a fatal error, exit 1. A .. after a symlink counts from the symlink's target, as realpath does. The .zfs rule applies to the real path. The walk still follows no symlink it finds.

Judgement call: records an earlier scan stored under a path through a symlink are not migrated; there is no installed base.

Model: opus-5-5

db.go

@@ -146,33 +146,44 @@ var errHashSize = errors.New("hash is not 32 bytes")
 
 // databasePath resolves the database location: SFDUPES_DATABASE when
 // set and non-empty, the compiled-in default otherwise. It returns the
-// path, with the working directory, its symlinks resolved, put in front
-// of it when it is relative, and where the path came from, "default" or
-// "from SFDUPES_DATABASE", for the line each subcommand prints first on
-// stderr.
+// path, made absolute by absolutePath, and where the path came from,
+// "default" or "from SFDUPES_DATABASE", for the line each subcommand
+// prints first on stderr.
 func databasePath() (string, string, error) {
 	path, source := defaultDatabasePath, "default"
 	if p := os.Getenv(databaseEnv); p != "" {
 		path, source = p, "from "+databaseEnv
 	}
 
-	if filepath.IsAbs(path) {
-		return path, source, nil
-	}
-
-	// The working directory as the kernel reports it, with no symlink
-	// in it, as README "Database" says. os.Getwd may return PWD
-	// instead, which can name it through a symlink.
-	wd, err := unix.Getwd()
+	abs, err := absolutePath(path)
 	if err != nil {
 		return "", "", fmt.Errorf("resolve database path %s: %w", path, err)
 	}
 
-	// Not filepath.Abs or filepath.Join: they clean the path, which
-	// drops each ".." together with the directory name before it. When
-	// that directory is a symlink, the cleaned path names another file.
+	return abs, source, nil
+}
+
+// absolutePath returns path unchanged when it is absolute, and
+// otherwise the working directory, a "/" and path. The working
+// directory is the one the kernel reports, with no symlink in it;
+// os.Getwd may return PWD instead, which can name it through a symlink.
+// The result is not cleaned, as filepath.Abs and filepath.Join would
+// clean it. Cleaning drops each ".." together with the directory name
+// before it. When that name is a symlink, the cleaned path names
+// another file than the one the system reaches by following the symlink
+// first.
+func absolutePath(path string) (string, error) {
+	if filepath.IsAbs(path) {
+		return path, nil
+	}
+
+	wd, err := unix.Getwd()
+	if err != nil {
+		return "", err
+	}
+
 	// The working directory ends in "/" only when it is the root.
-	return strings.TrimSuffix(wd, "/") + "/" + path, source, nil
+	return strings.TrimSuffix(wd, "/") + "/" + path, nil
 }
 
 // createDatabaseDirectory creates the directory the database at path