Bubble errors up from worker goroutines; exit non-zero on failure

[dolph]

Summary

• Replaces every log.Fatal* outside of main in find_replace.go and file_handling.go with returned errors so deferred cleanup runs on failure.
• Error-aggregation primitive: a small errAccumulator (sync.Mutex + []error, exposed via errors.Join) embedded on findReplace. Each error is also log.Print'd at the point of failure so the existing operator-visible stderr stream (Renaming/Rewriting lines and per-error context) is preserved; the join exists so main can surface a non-zero exit code, and so errors.Is / errors.As unwrap the entire accumulated chain. This matches the "log and continue" semantic the issue calls for and intentionally avoids errgroup (which stops on the first error). The struct stays small so the upcoming bounded-worker-pool change (Unbounded goroutine fan-out exhausts file descriptors and memory on large trees #7) can drop in without rearchitecting again.
• main is now a thin os.Exit wrapper around run(args, stderr) int, making argument parsing and the success/failure exit code testable from inside the package.
• File.Write defer os.Remove(tempName)s immediately after creating its temp file. On success the file no longer exists at tempName, so the remove is a no-op; on rename failure the temp file is cleaned up instead of being leaked.

Architectural shape (for #7 / #8 follow-ups)

Function	Before	After
NewFile	log.Fatalf on Abs error	(*File, error)
File.Info	log.Fatalf on stat error	(os.FileInfo, error)
File.Read	log.Fatalf on open/seek/read	(string, error)
File.Write	log.Fatalf, no temp cleanup	error, deferred temp os.Remove
WalkDir	log.Fatalf on ReadDir	logs + records on errAccumulator, continues siblings
HandleFile / RenameFile / ReplaceContents	log.Fatalf	error (walker logs + records)
main	log.Fatal for usage; WalkDir(NewFile("."))	run(args, stderr) int; non-zero on any recorded error

Test plan

New tests (each verified to fail for the right reason against the previous behavior before the matching fix was landed):

• TestWalkDir_PermissionDeniedSubdirContinues — a chmod 0 subdirectory no longer aborts the walk. The sibling subtree is still rewritten; the walker records an fs.ErrPermission referencing the failing path. Skips under root (chmod is a no-op there) and on Windows.
• TestRenameFile_ReturnsErrorOnExistingDestination — an occupied destination yields an error rather than a log.Fatal. Source and destination both still exist afterwards.
• TestWalkDir_BadRenameTargetDoesNotAbortSiblings — a sibling whose post-rename name is already occupied does not abort the rest of the tree; the walker logs and records the failure and continues with the free file.
• TestWriteCleansUpTempFileOnRenameFailure — forcing the rename to fail (target is a non-empty directory; deterministic under both root and non-root on Linux) leaves no stray temp file behind. (Verified the test fails without the deferred os.Remove.)
• TestRun_ExitsZeroOnSuccess, TestRun_ExitsNonZeroOnTraversalError, TestRun_BadArgCountPrintsUsage — run() returns 0 on a clean walk, non-zero on any recorded error, and prints the usage line to its stderr writer on bad arg count.

Dev loop:

• gofmt -l . — no output
• go vet ./... — no output
• go build ./... — no output
• go test -race ./... — PASS (also verified by running the full suite under nobody so the root-guarded test exercises the real permission path)
• ./build.sh — green, coverage 80.5%

Issues closed

Closes #6
Closes #11
Closes #5

The --strict flag mentioned in #6's body is intentionally not part of this PR (it's an additive CLI surface change requiring release:minor + a README update); the per-error-log-and-continue policy described in the issue is the default. File-able as a separate enhancement if desired.

https://claude.ai/code/session_01Tep5t8h97Q9KKbpLMbUEJr

---

Generated by Claude Code