scan: skip OS-appropriate default excludes (/proc, /sys, /tmp, /run, /var/tmp on Linux) (closes #124)

Below an operand, the walk no longer enters the default excludes: on
Linux /proc, /sys, /dev, /run, /tmp, /var/tmp and every mount point of a
kernel or memory-backed filesystem, read once from /proc/self/mountinfo;
on macOS /dev, /private/tmp, /private/var/tmp, /private/var/vm,
/System/Volumes/VM and /System/Volumes/Data. The lists live in the new
exclude.go. An operand at or inside one is still walked, also under
another operand, as with -x. Each skipped directory gets one stderr line
through the warning path, is not counted as skipped, and its records
count as outside the scanned operands. --no-default-excludes turns them
off; scan --help lists them.

Judgement call: an unreadable /proc/self/mountinfo fails the scan.
Judgement call: where filesystems are mounted over one another, the last decides.

Model: opus-5-5

TODO.md

@@ -29,6 +29,19 @@
 
 # Completed Steps
 
+- below an operand, `scan`'s walk does not enter the default excludes, so
+  `sfdupes scan /` skips the kernel's view of the running system and the
+  temporary directories: on Linux `/proc`, `/sys`, `/dev`, `/run`, `/tmp`,
+  `/var/tmp` and the mount point of every kernel or memory-backed filesystem,
+  read from `/proc/self/mountinfo` as the scan starts; on macOS `/dev`,
+  `/private/tmp`, `/private/var/tmp`, `/private/var/vm`, `/System/Volumes/VM`
+  and `/System/Volumes/Data`. An operand at or inside one is still walked. The
+  scan prints a line for each it does not enter, as it prints a warning, without
+  counting it as skipped, and the records below it count as outside the scanned
+  operands, as for `-x`. `--no-default-excludes` turns them off, and
+  `scan --help` lists them (2026-10-16,
+  https://git.eeqj.de/sneak/sfdupes/issues/124)
+
 - the rate a progress display shows covers the items completed over the last 5
   seconds, or since the line before when stderr is not a terminal, so it falls
   to 0 while nothing completes, and a burst after a wait no longer reads as a