fix(scan): bound the subnet and stop waiting on devices one at a time

[gclluch]

Two problems with the same root: discover treated the network as a list to walk rather than a set of waits to overlap.

A scan cost the sum of every timeout on the network. nudge has used a 128-worker pool since the beginning, but the step after it - reverse DNS and the port scan, per device, both pure waiting - ran one device at a time, and the ports inside each ran one at a time too. The audit's banner grab was worse: a 2s timeout per open port, sequentially, and a TLS port never greets so it always costs the full 2s. Per-device work now goes through a pool, and grab_banners gathers the whole set at once. Wall clock is the slowest single device instead of the total.

Nothing bounded the subnet. netdiff scan 10.0.0.0/8 materialised 16.7M address strings and handed them all to the nudge pool before a packet moved. ARP does not cross routers, so a subnet that large is a typo rather than a request - refused up front with the reason.

While in there: a bad CIDR reached the user as a traceback, since the subnet is parsed deep inside discover rather than at the argparse layer. main now turns a ValueError into a message and exit 2, which covers both cases.

Tests are timed rather than only checked for their return value - a pool that quietly stops being used still returns the right answer.