Test the -x filesystem-boundary rejection branch (closes #17)

The -x descent rules in subdirJob had no test executing the actual
rejection: the only case proved -x skips nothing when everything is on
one filesystem. Add tests that call subdirJob directly with a fabricated
operand device, so no second real filesystem is needed:

- reject descent when the subdirectory is on a different device;
- bypass the check when the operand's own device is unknown;
- warn and refuse descent when the entry's Info() fails;
- cross the boundary by default (no -x).

Tests only; scan.go is unchanged.

Model: opus-4-8

TODO.md

@@ -29,6 +29,12 @@
 
 # Completed Steps
 
+- test the `-x` filesystem-boundary rejection branch by calling
+  `subdirJob` directly: reject across a boundary, bypass when the root
+  device is unknown, stat-error warning, and default crossing
+  (2026-09-21, branch `next`, closes
+  https://git.eeqj.de/sneak/sfdupes/issues/17)
+
 - fix the lint-image pin comments and `FROM` form in `Dockerfile` and
   `Dockerfile.lint` (2026-08-10, branch `next`, closes
   https://git.eeqj.de/sneak/sfdupes/issues/25): dropped the false