fix: scan only subschema positions, await stderr, show the whole report

Copilot review round 6.

- Share one traversal between `walk` and `declaresAnyId`. The `$id` guard
  added last round descended through EVERY object value, including
  instance data — `examples: [{"$id": "x"}]`, a `default`, a `const` —
  where `$id` is a payload key declaring no embedded resource. Reading
  one there suppressed `remote-ref` for the whole document, turning last
  round's false-positive fix into a blanket false negative. Both passes
  now go through `forEachSubschema`, driven by the same keyword tables,
  so they cannot drift about what counts as a schema position.

- Await the stderr writes. `writeSchemaLintReport` used a bare
  `process.stderr.write`, but both CLI exit paths call `process.exit()`
  as soon as the work returns, which discards anything still buffered on
  a piped stderr — truncating or losing the multi-block `--strict`
  report on exactly the redirected-output runs a CI caller uses. Added
  `awaitableError` beside the existing `awaitableLog` and awaited it.
  The test's fake defers its callback so a synchronous one cannot make
  the assertion vacuous; two existing stderr stubs that never invoked
  their callbacks were fixed in the same pass.

- Show the CLI README's sample report in full. It printed one error
  block immediately followed by the summary, a shape the formatter
  cannot produce — every finding gets a block. Captured from a real run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL9retfvAXRgvi6EWk4SY4
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/cli/src/utils/awaitable-log.ts

@@ -5,3 +5,21 @@ export function awaitableLog(logValue: string): Promise<void> {
     });
   });
 }
+
+/**
+ * The stderr twin of {@link awaitableLog}.
+ *
+ * Both CLI exit paths call `process.exit()` as soon as the work returns
+ * (`src/index.ts`, and `handleError` in `src/error-handler.ts`). When stderr
+ * is a pipe or a file rather than a TTY, `write` is asynchronous, so anything
+ * still buffered at that moment is discarded — which for a multi-block
+ * `--strict` report means a truncated or entirely missing diagnostic on
+ * exactly the redirected-output runs a CI caller uses.
+ */
+export function awaitableError(logValue: string): Promise<void> {
+  return new Promise<void>((resolve) => {
+    process.stderr.write(logValue, () => {
+      resolve();
+    });
+  });
+}