Share the bounded read in scaffold and the blocked exit in doctor

[Deicyde]

Follow-up to #96. No behaviour change: 3 files, +23/-66, one commit per item.

• _read_at_most (scaffold.py). _read_bounded_regular_file and _read_gitignore_descriptor each had their own chunked loop that read in 64 KiB pieces until end of file or one byte past the limit. The two now share one loop. The .gitignore reader used to raise inside its loop once the total passed _MAX_GITIGNORE_BYTES. It now checks the length after the read, which covers the same bytes and raises the same error.
• Doctor's blocked exits (doctor.py). The graph-validation exit and the runtime-projection exit each appended the references, audit and lean targets checks by hand. The blueprint-resolution exit already used _blocked_result, which fills the remaining checks in _CHECK_NAMES order with the same names and text. All three exits now use it.
• Scaffold test imports (tests/test_scaffold.py). 18 tests imported autoform_cli.scaffold as scaffold_module inside the function, although the module already imports it at line 21.

Noticed, not changed:

• _blocked_lean_check now has only one caller, _blocked_result.
• No test checks the references and audit details on the two exits that moved. Their output is unchanged, because _blocked_result builds the same checks.
• The size check after the read in _read_bounded_regular_file fires only if the file grows between the stat and the read. No test reaches it, on this branch or on main.

Overlaps with open PRs:

• Add verified statement-review bundles #75 edits all three files, Scale roadmap inventories and the full DAG explorer #90 and Rebuild artifact verification on bound project evidence #145 edit tests/test_scaffold.py, and Deploy Pages only after autoform verify passes, and refuse a lean: name defined twice #140 and Bind statement: formalized to a recorded statement_hash #141 edit doctor.py.
• Each merges with this branch without adding a conflict.
• None of them can be test-merged with this branch yet: Add verified statement-review bundles #75, Scale roadmap inventories and the full DAG explorer #90 and Rebuild artifact verification on bound project evidence #145 already conflict with main, and Deploy Pages only after autoform verify passes, and refuse a lean: name defined twice #140 and Bind statement: formalized to a recorded statement_hash #141 target open-statements-revision, which conflicts with main.
• This branch also merges cleanly with Treat undecodable git output as no answer when pinning the plugin #178, which edits scaffold.py and tests/test_scaffold.py.

Validation at exact head 39ce5f88: ruff check autoform_cli servers tests is clean. tests/test_scaffold.py (105), tests/test_doctor.py (14), tests/test_cli.py (5) and tests/test_project_create.py (257) pass.