When a width specifier was given (e.g. %4095s), `str` was advanced by
that width regardless of the actual token length. Parsing a short token
on a small buffer would therefore walk past the end of the input, causing
reads from unmapped memory and a kernel crash.

Fix: clamp the advance to `strcspn(str, whitespace)` before moving the
pointer forward. Applied to both the %s and numeric specifier paths.

…f with safe custom parser

- Replace sscanf-based line parsing with explicit parse_token /
  parse_mount_line helpers that never over-advance past the token end
  and properly decode octal-escape sequences (e.g. \040 for spaces).
- Add -h / --human-readable: sizes are shown in powers of 1024
  (B / K / M / G / T) instead of raw 1K-block counts.
- Column header changes dynamically ('Size' vs '1K-blocks').

- Add event-driven long/short option parser (supports clusters, --, --opt=value,
  required/optional values) with explicit error codes.
- No dynamic allocation and no internal static state.
- Integrate df argument parsing using the new parser for -h/--human-readable and --help.
- Keep strict handling of unexpected positional arguments for df.