During a CIS-style security baseline review, you must produce a list of all files on the root filesystem that have the setuid bit set, so the security team can verify each one against an approved allowlist. The scan must not descend into other mounted filesystems. Which command accomplishes this?