fontique: use getattrlistbulk for directory scanning on macOS

[nicoburns]

Summary

Stacked on #4. Uses the getattrlistbulk crate (MIT/Apache-2.0, macOS-only dep, published Jan 2026) so directory enumeration retrieves names, types, modification times, and sizes in batched syscalls instead of readdir + one stat per entry.

Key restructuring in scan.rs:

• collect_font_files now returns Vec<(PathBuf, Option<FileStamp>)> — the walk produces cache stamps as a byproduct, so parse_files_cached no longer re-stats every file (it only falls back to fs::metadata when the walk couldn't provide a stamp, e.g. explicitly-listed file paths).
• Directory listing is split into a platform-specific walk_dir: on macOS it uses getattrlistbulk::read_dir requesting {name, object_type, modified_time, size} (symlinks/unknown types fall back to the metadata-following generic path); elsewhere it keeps std::fs::read_dir.

The CoreText backend also drops its own duplicate collect_files walker: library_font_dirs() now returns the Library/Fonts directories and passes them into the shared scan with max_depth = 8, so those walks go through the bulk-syscall path too. The per-descriptor path.exists() check (one stat per font) is removed since the scan skips missing files anyway.

Net effect on warm start with the cache from #4: syscall count for the whole scan drops to roughly one open + a few getattrlistbulk calls per directory, plus one stat per explicitly-enumerated font file path.

Verified: clippy/check clean on aarch64-apple-darwin, aarch64-apple-ios (where getattrlistbulk isn't pulled in), Linux, Windows, wasm, and a no-std target; scan/cache tests pass. As with the rest of the stack, real timing needs measuring on a Mac.

Link to Devin session: https://dioxus.staging.devinenterprise.com/sessions/60a3d833a0894a73945c806adff1cbf3
Requested by: @nicoburns

[staging-devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring