Scan and grep concurrency, matching, and SEA worker contracts

In src/lib/scan/, whole-buffer regex execution can lose overall because early exit at maxResults dominates across many files. Literal prefilters are file-level gates; per-line checks break cross-newline patterns and Unicode case folding. Character-group skipping must handle character classes. Use a latched pendingWake flag to avoid wake races. mapFilesConcurrent filters null, not []; return null for no-op files. Collectors must drain uncapped and set truncated themselves. The worker pool is lazy, bounded by available parallelism, uses transferred Uint32Array match quads, and keeps FIFO work per worker. Blob URLs are required because new Worker(new URL(...)) hangs in SEA binaries. Only unref() when inflight work reaches zero; disable workers with SENTRY_SCAN_DISABLE_WORKERS=1.