feat: add --must-match to exit non-zero when nothing matched

[vlasky]

Implements #157.

Problem

sd exits 0 whether or not the pattern matched, mirroring sed. That makes a typo in the pattern indistinguishable from a file that genuinely needed no changes:

$ echo "foo" | sd 'typo' 'bar'
foo
$ echo $?
0

In a script or CI job, a vacuous edit passes silently. As noted on #157, this is troublesome enough that people fall back to sed to detect whether anything was replaced.

Change

An opt-in -m / --must-match flag that exits 2 when the pattern matched none of the input:

$ echo "foo" | sd -m 'typo' 'bar'
foo
$ echo $?
2

The default is deliberately unchanged. On #157 @CosmicHorrorDev wrote:

Just to be clear I wasn't thinking of changing the default behavior. We should typically default to matching sed's behavior which we do already here

and

I was thinking something along the lines of a --must-match flag

so this is that flag rather than a change of default.

Design points:

• Exit 2, not 1. Errors keep 1, so a script can tell "your pattern found nothing" apart from "sd could not do its job". The man page's hardcoded EXIT STATUS section lists the new code.
• The status describes the run, not each input. One matching file out of several is enough to succeed, which is what a sd -m ... *.rs invocation wants.
• The flag only affects the exit status. Inputs that did match are replaced either way; nothing is made conditional or rolled back.
• No extra work to detect a match. Replacer::replace already returns Cow::Borrowed when the pattern did not match and Cow::Owned otherwise, so the variant answers the question without a second scan. That contract is now documented on replace.

process_sources and its helpers return Result<bool> reporting whether anything matched, leaving the exit-status policy in the CLI.

Testing

11 new tests, taking the workspace from 48 to 60. Three at the library level for the returned bool, and eight CLI tests covering: default unchanged (exit 0 for both a matching and a non-matching run, file and stdin), --must-match with and without a match, stdin, -p, -A, a multi-file run where only one file matches, and that an error still exits 1 rather than 2. Each behavioural case is exercised through both the line-by-line and whole-file paths.

cargo fmt --check and cargo clippy --workspace --all-targets -- -D warnings are clean. gen/ completions and the man page are regenerated via cargo run -p xtask -- gen.

Notes

• Documented under a new "Requiring a match" section in the README.
• I have left CHANGELOG.md alone, since its history looks like maintainer-written release prep. Happy to add an entry if you would prefer it in the PR.
• This shares a README conflict with feat: reject replacement references to undefined capture groups #346 (both append a section at the end); the code files merge cleanly. Whichever lands second, I will rebase.