fix: NIF scan warns on dev/test-only deps that are never in the release

[joshrotenberg]

Problem

mix tinfoil.plan warns about NIFs in dependencies that cannot appear in the
built artifact, because the scan does not filter by environment or runtime:.

hexpm-mcp (joshrotenberg/hexpm-mcp#68):

  NIF warnings (may not cross-compile cleanly):
    file_system: has c_src/ directory; C extensions may not cross-compile cleanly

file_system is pulled in by credo:

├── credo ~> 1.7 (Hex package)
│   ├── file_system ~> 0.2 or ~> 1.0 (Hex package)

and credo is declared only: [:dev, :test], runtime: false. The build runs
under MIX_ENV=prod, so file_system is not compiled into the release and
cannot affect cross-compilation. MIX_ENV=prod mix deps confirms it is absent.

Why it matters

The warning is the one signal tinfoil gives about the single most likely cause
of a broken cross-compiled binary. A false positive on the first run trains
people to ignore it, which costs more than not having the check. It also makes
the plan output look like the project has a problem it does not have.

Fix

Filter the scanned dep set the same way the build resolves it: environment
(:prod, or whatever the build runs under) and runtime: false. Warn only for
deps that will actually be in the release.

Two candidate approaches:

• Resolve Mix.Dep.load_on_environment(env: :prod) and scan that set rather
  than walking deps/ on disk.
• Read the release's resolved applications, which is the most accurate answer
  since it is what actually gets packaged, though it requires the release to be
  assembled first and plan is meant to be cheap and read-only.

The first is probably the right trade for a plan-time check.