Refuse an empty --require-signature or --sign-key (closes #205)

check, fetch, gen and freshen took --require-signature or --sign-key
given an empty value, on the command line or through
MFER_REQUIRE_SIGNATURE or MFER_SIGN_KEY, as the flag not given, so an
unset shell variable skipped the signature check or the signing. Each
now asks whether the flag was given, as gen's --output does. An empty
fingerprint is refused as one of the wrong length, by fetch before it
requests anything; an empty --sign-key is refused, naming the flag,
before any file is read.

Model: opus-5-5

internal/cli/check.go

@@ -329,10 +329,10 @@ func (mfa *CLIApp) checkManifestOperation(
 		return fmt.Errorf("load manifest: %w", err)
 	}
 
-	// Check signature requirement
-	requiredSigner := cmd.String(flagRequireSignature)
-	if requiredSigner != "" {
-		err = verifyRequiredSigner(chk, requiredSigner)
+	// Check signature requirement. An empty fingerprint is checked too,
+	// and refused as one of the wrong length.
+	if cmd.IsSet(flagRequireSignature) {
+		err = verifyRequiredSigner(chk, cmd.String(flagRequireSignature))
 		if err != nil {
 			return err
 		}