Stop scan cleanly on SIGINT or SIGTERM (closes #5)

A first SIGINT or SIGTERM cancels the scan. It commits the hashed
records still in its batch, with a context that is not cancelled for
that one write, and starts no other write or deletion; deletions need
a complete walk, so records under paths an interrupted walk never
reached are kept. A batch whose commit failed is now kept for that
final commit instead of dropped. The progress display is finished (a
bar stopped short is no longer filled up), `scan: interrupted after N
files` goes to stderr, and the exit code is 1. A second signal ends the
process at once. A SIGINT inherited as ignored stays ignored.

Model: opus-5-5

TODO.md

@@ -29,6 +29,10 @@
 
 # Completed Steps
 
+- `scan` stops cleanly on `SIGINT` or `SIGTERM`: commits what it has
+  hashed, deletes nothing more, exits 1 (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/5)
+
 - `report` and `trees` stream the records instead of holding them all in
   memory; the schema gains the `files_signature` index (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/14)