Scan out-param / nullable Doxygen from the source, not the parsed headers

[estebanzimanyi]

Problem

The may be NULL and @param[out] Doxygen tags are a property of the MEOS C source (meos/src/**/*.c), but run.py scanned them from HEADERS_DIR.parent.

On the provision-meos build-libmeos: true path, HEADERS_DIR is the installed headers (the generated meos_export.h, deliberately parsed there so base-type I/O like interval_in is visible) — whose parent has no src/. So the scan finds 0 out-params and 0 nullable, even though the source has 459 / 95.

With no shape.outParams, the codegens cannot fold single out-param wrappers, so functions like ttext_value_at_timestamptz(temp, t, strict, text **value) emit unfolded (the out-param stays a visible argument). Every binding whose hand-written surface calls the folded form then fails to compile — e.g. JMEOS:

ttext_value_at_timestamptz  required (Pointer, OffsetDateTime, boolean, Pointer) — call passes 3
set_as_hexwkb               required (Pointer, byte, Pointer)                    — call passes 2
textset_value_n             required (Pointer, int, Pointer)                     — call passes 2

This breaks the catalog for every build-libmeos: true consumer (JMEOS, MEOS.NET, Spark, …); the catalog-only path (javadoc) was unaffected because it parses the source header tree.

Fix

Scan the Doxygen tags from the source checkout (MDB_SRC_ROOT/meos) — the same root the @sqlfn/@ingroup maps already use — falling back to the header tree's parent when the headers are themselves a source checkout (no MDB_SRC_ROOT). Signature parsing still uses the installed headers unchanged.

Verified: simulating the build path (installed-headers dir with no sibling src/, MDB_SRC_ROOT=source) now reports nullable: 95, out params: 459, and ttext_value_at_timestamptz/textset_value_n/set_as_hexwkb regain their shape.outParams. The normal full-source path is unchanged.