internal/scanner: close output file on encode error

[Dev-X25874]

os.Create opens a file descriptor that is never closed if
json.NewEncoder(f).Encode(stmt) subsequently fails. In a multi-target
scan this leaks one fd per failing target.

Extract the write into a writeStatement helper that defers f.Close,
using a named return so the close error is not silently dropped on the
happy path.

Add unit tests for writeStatement and loadPathFromEnvironment.