Fix config-not-found errors, dev-build hint, unify output writer

ResolveConfigPath now stats explicit paths from --config and
$VAULTIK_CONFIG and produces an actionable error naming the bad
path and suggesting 'vaultik config init' (with the right path
in the --config case). The default-search failure message lists
the paths it tried.

The scanner no longer hard-codes os.Stdout vs io.Discard based on
EnableProgress. ScannerConfig and ScannerParams take an explicit
Output io.Writer, and the Vaultik caller passes v.Stdout — which
itself is set to io.Discard in --cron mode. One knob controls
both scanner-level and Vaultik-level user-facing output.

The version command prints a hint when Version == "dev" telling
the user this is a development build without embedded version
metadata.

internal/snapshot/module.go

@@ -1,6 +1,8 @@
 package snapshot
 
 import (
+	"io"
+
 	"github.com/spf13/afero"
 	"go.uber.org/fx"
 	"sneak.berlin/go/vaultik/internal/config"
@@ -11,6 +13,7 @@ import (
 // ScannerParams holds parameters for scanner creation
 type ScannerParams struct {
 	EnableProgress bool
+	Output         io.Writer // Where one-off scanner messages go; nil disables them
 	Fs             afero.Fs
 	Exclude        []string // Exclude patterns (combined global + snapshot-specific)
 	SkipErrors     bool     // Skip file read errors (log loudly but continue)
@@ -46,6 +49,7 @@ func provideScannerFactory(cfg *config.Config, repos *database.Repositories, sto
 			CompressionLevel: cfg.CompressionLevel,
 			AgeRecipients:    cfg.AgeRecipients,
 			EnableProgress:   params.EnableProgress,
+			Output:           params.Output,
 			Exclude:          excludes,
 			SkipErrors:       params.SkipErrors,
 		})

internal/snapshot/scanner.go

@@ -92,10 +92,11 @@ type ScannerConfig struct {
 	Storage          storage.Storer
 	MaxBlobSize      int64
 	CompressionLevel int
-	AgeRecipients    []string // Optional, empty means no encryption
-	EnableProgress   bool     // Enable progress reporting
-	Exclude          []string // Glob patterns for files/directories to exclude
-	SkipErrors       bool     // Skip file read errors (log loudly but continue)
+	AgeRecipients    []string  // Optional, empty means no encryption
+	EnableProgress   bool      // Enable the live progress reporter (ETAs, throughput)
+	Output           io.Writer // Where one-off scanner messages go; nil disables them
+	Exclude          []string  // Glob patterns for files/directories to exclude
+	SkipErrors       bool      // Skip file read errors (log loudly but continue)
 }
 
 // ScanResult contains the results of a scan operation
@@ -142,9 +143,9 @@ func NewScanner(cfg ScannerConfig) *Scanner {
 	// Compile exclude patterns
 	compiledExclude := compileExcludePatterns(cfg.Exclude)
 
-	output := io.Writer(io.Discard)
-	if cfg.EnableProgress {
-		output = os.Stdout
+	output := cfg.Output
+	if output == nil {
+		output = io.Discard
 	}
 
 	return &Scanner{