Add scan --exclude PATH (closes #163)

The walk neither enters nor records an --exclude path or anything
below it, and prints "scan: skipped PATH (--exclude)" for each one it
reaches. The flag repeats. The walk knows each --exclude path by
device ID and inode number, as it knows the database files, so it also
leaves one out when it reaches it by another path, such as a hard
link. The records below an excluded path are kept, as for a default
exclude. An empty value is a usage error. An --exclude path whose real
path scan cannot find, or an operand at or below one, is a fatal error
before the scan starts. walkRules names its two lists excludePaths and
defaultExcludes. printDatabasePath, split out of runScan, keeps runScan
under the lint length limit.

Model: opus-5-5

TODO.md

@@ -29,6 +29,11 @@
 Newest first. An entry ends with its date and its issue or branch, where those
 are known.
 
+- New `scan` flag `--exclude PATH`, which may be repeated. The walk neither
+  enters nor records an excluded path, and keeps the records below it. An
+  operand at or below one is a fatal error (2026-11-11,
+  https://git.eeqj.de/sneak/sfdupes/issues/163)
+
 - `report` and `trees` leave out a copy that was deleted after the scan. Each
   checks only the copy itself with `lstat`: the file, or the directory at the
   top of a tree. A group left with one copy is not reported. A missing `scan`