fix: distinguish missing .gitignore from unreadable one

An empty catch was treating permission errors the same as 'no
.gitignore exists'. Now only ENOENT is silently ignored; any other
error (EACCES, EISDIR, etc.) is added to the scan error list.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>