Bug: scan --format json leaks progress/warn logs to stdout #402

Problem

When running cora scan --format json, progress messages and warnings are printed to stdout instead of stderr, contaminating the JSON output.

Reproduction

cora scan --format json > output.json 2>/dev/null
# output.json contains non-JSON lines (WARN, progress)

Expected

--format json should output only valid JSON to stdout. All progress/warn/debug messages must go to stderr.

Root Cause

In src/commands/scan.rs, progress messages use println! (stdout) instead of eprintln! (stderr).

Impact

• Cannot pipe --format json to jq, Python JSON parser, or any JSON consumer
• Breaks CI pipelines that expect clean JSON
• Affects all --format json consumers

Fix

Replace println! with eprintln! for all progress/warn messages in scan.rs when format is json. Ideally, all progress messages should always go to stderr regardless of format.