Handle symlinked scaffold files safely in heartbeat and drift scans

[theDakshJaitly]

Follow-up from Copilot review on PR #39.

Problem

scaffoldHeartbeatFiles and the drift scanner use globbing with follow: true. This supports symlinked scaffold content, but it may also create duplicate file entries or unsafe traversal behavior if users have symlink loops inside .mex/.

Suggested fix

Confirm the intended symlink behavior and either:

• de-duplicate scanned files by real path, or
• stop following symlinks where unsafe, or
• document the behavior clearly for users upgrading from v0.2.

Acceptance criteria

• Symlinked scaffold files do not produce duplicate heartbeat/drift entries.
• Cyclic symlinks do not cause runaway scanning.
• Behavior is covered by a focused test or documented as unsupported.

Source: #39 (comment)