fix: scan only subschema positions, await stderr, show the whole report

Copilot review round 6.

- Share one traversal between `walk` and `declaresAnyId`. The `$id` guard
  added last round descended through EVERY object value, including
  instance data — `examples: [{"$id": "x"}]`, a `default`, a `const` —
  where `$id` is a payload key declaring no embedded resource. Reading
  one there suppressed `remote-ref` for the whole document, turning last
  round's false-positive fix into a blanket false negative. Both passes
  now go through `forEachSubschema`, driven by the same keyword tables,
  so they cannot drift about what counts as a schema position.

- Await the stderr writes. `writeSchemaLintReport` used a bare
  `process.stderr.write`, but both CLI exit paths call `process.exit()`
  as soon as the work returns, which discards anything still buffered on
  a piped stderr — truncating or losing the multi-block `--strict`
  report on exactly the redirected-output runs a CI caller uses. Added
  `awaitableError` beside the existing `awaitableLog` and awaited it.
  The test's fake defers its callback so a synchronous one cannot make
  the assertion vacuous; two existing stderr stubs that never invoked
  their callbacks were fixed in the same pass.

- Show the CLI README's sample report in full. It printed one error
  block immediately followed by the summary, a shape the formatter
  cannot produce — every finding gets a block. Captured from a real run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL9retfvAXRgvi6EWk4SY4
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/core/schemaLint.test.ts

@@ -492,6 +492,32 @@ describe("lintToolSchemas — remote-ref", () => {
     ).toEqual([]);
   });
 
+  it.each([
+    ["examples", { examples: [{ $id: "payload-field" }] }],
+    ["default", { default: { $id: "payload-field" } }],
+    ["const", { const: { $id: "payload-field" } }],
+    ["enum", { enum: [{ $id: "payload-field" }] }],
+  ])(
+    "is not disabled by an $id that is instance data under %s",
+    (_label, dataCarrier) => {
+      // `$id` inside `examples`/`default`/`const`/`enum` is a payload key, not
+      // an embedded schema resource — reading one there would switch this rule
+      // off for the whole document.
+      const findings = lintToolSchemas(
+        tool({
+          inputSchema: {
+            type: "object",
+            properties: {
+              a: { type: "string", ...dataCarrier },
+              b: { $ref: "https://example.com/s.json" },
+            },
+          },
+        }),
+      );
+      expect(rules(findings)).toEqual(["remote-ref"]);
+    },
+  );
+
   it("still fires when no $id is declared anywhere", () => {
     const findings = lintToolSchemas(
       tool({