fix(discover): report a symlink skip through the ignored-files taxonomy

[AmirF194]

What does this PR do?

walk_dir_process_entry rejects a directory entry when safe_stat() skips it as a symlink or reparse point, but that branch returns with a bare return; and never calls file_list_add_ignored, unlike its two sibling skip paths a few lines below (directory exclusion, file skip_reason). A file reachable only through a symlinked directory disappears from the index with no trace in not_indexed/skipped/parse_partial, so a symlink-heavy subtree looks identical to a complete index (#1815).

This is the narrower, buildable half of #1815 that DeusData already called out separately from the traversal-contract question (whether symlinks should be followed), which they said needs more design time. This PR does not touch that decision.

safe_stat() now takes an is_symlink out-param reporting whether a rejection was specifically the symlink/reparse-point check (as opposed to some other stat failure). walk_dir_process_entry records the entry via file_list_add_ignored(out, rel_path, "symlink") when so. The count_only path is untouched.

Rebase risk, not a conflict of claims: open PR #1803 also changes safe_stat()'s signature (adds its own is_link out-param) to fix a different bug, count_only aborting discovery entirely on any symlink. If #1803 merges first, this branch will need a rebase to reuse its out-param instead of adding a second one; read its full diff before assuming a collision, it does not add any ignored-file reporting itself.

Verification

• New regression test discover_symlink_skip_is_reported (tests/test_discover.c) fails on unmodified main (ignored_total == 0, expected 1) and passes on this branch; ran both in a clean ubuntu:24.04 container via scripts/test.sh --suites discover, 114/114 passed, no leaks under the default ASan/LSan build.
• Full scripts/test.sh (all suites) passes in the same container, with one exception: tests/test_parallel_harness_contract.sh's stubborn_tree case fails without docker run --init; confirmed it passes identically with --init on a fresh container, so it is a container-PID-1 artifact of my verification setup, not related to this diff (it does not touch anything under src/discover/).
• scripts/lint.sh --ci with the exact versions CI pins (cppcheck 2.20.0 built from source, clang-format-20): both changed files are clean. The overall script still exits non-zero because of pre-existing clang-format-20 drift in src/mcp/mcp.c and src/pipeline/pipeline_incremental.c, both untouched by this diff, confirmed present on unmodified main.
• Not verified: the Windows branch of safe_stat() (also updated, same shape) has no Windows environment available here; and lint-mem's path-sensitive clang-tidy analyzer (CI job, 60-minute budget, whole-repo) was not run locally.

Fixes #1815

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.