Add os_signpost instrumentation for scan phases

[RasputinKaiser]

Summary

• Purely additive os_signpost spans for Instruments profiling of scan-side work. No behavioral changes; emits begin/end intervals that are no-ops when no profiler is attached.
• FileSystemScanner: top-level scan span wraps the whole scan, enumerate wraps each concurrentPerform child iteration, verify wraps each duplicate-hash verification group iteration.
• ScanStore: persist wraps the post-scan hashCache.persist() call (in the detached utility task).
• FilterStore: index wraps rebuildSearchSubtreeMatchIDs.
• Shared OSLog(subsystem: "com.rasputinkaiser.StorageScope", category: "scan") across all three classes so spans cluster in the Instruments timeline.

Validation

• swift test — 54/54 passing
• ./script/public_upload_audit.sh — passed
• bash ./script/build_and_run.sh --verify — app bundle signature and launch verified

Privacy And Safety

• No signing files, provisioning profiles, app bundles, DMGs, packages, scan outputs, Codex state, or local-only handoff docs are committed.
• No new file access, cleanup, duplicate detection, or local data handling. Signpost spans emit no PII — %{public}@ paths are local file names only and never written to disk by StorageScope.