Block a user
check reports symlinks gen never lists as extra files, so --no-extra-files cannot pass on a tree with a directory symlink
Report only symlinks to regular files as extra files in check (closes #192)
A path named help or h runs the help instead of the command, so check help --require-signature FPR passes
Read a path or URL named help or h as an argument (closes #198)
Release mechanics for v1.0.0: version single-sourcing and tag
Take the version from the git tag, not a constant (closes #80)
freshen rewrites a signed manifest unsigned when --sign-key is not given
Refuse to freshen a signed manifest without --sign-key (closes #191)
Hold runMu in internal/cli tests that log outside a CLI run (closes #210)
next is red: TestCheckQuietShowsFailedFiles catches log lines from tests running outside runMu