One panic shouldn't kill the scan: isolating rules with catch_unwind

The abort profile is also the one setting your tests can't catch. Cargo ignores the panic setting for tests and benchmarks, because the test harness needs unwinding, so a test that panics inside a rule and checks that the scan continues will still pass after someone adds panic = "abort" to the size profile. A compile-time guard closes that gap: put #[cfg(panic = "abort")] compile_error!("rule isolation needs panic = unwind"); next to the dispatch, and the build that would break isolation fails instead of shipping.

I'd also put the skipped rule in the report, not only in the log. For a cost tool, a missing finding reads as no waste found, so a line saying rule 57 panicked on that EBS volume tells the reader which part of the account the report didn't check.