pub fn scan(binary_path: &Path, atomcode_dir: &Path) -> Result<Plan>
Walk the filesystem and produce a Plan. Missing paths are silently skipped. Order: Group::Binary first, then Credentials, then State.