Make error message wording consistent (closes #165)

Error messages in mfer/ and internal/cli/ are lowercase except names and
acronyms, carry no "failed to" or command-name prefix, and each wrap names
only the operation and thing the wrapped error does not already name, so a
stacked message names what failed once. Wraps around errors that already
name their operation and path (os and afero path errors, url.Error, the
builder's path errors, the gpg helpers' own errors) are dropped. gpg's
stderr is appended to a gpg failure, and to the error for a signing key gpg
did not report, only when gpg wrote some. errHTTPStatus reads "unexpected
HTTP status"; both inner-not-set sentinels read "inner message not set".
No sentinel, errors.Is result or exit status changes.

Model: opus-5-5

internal/cli/fetch_test.go

@@ -502,8 +502,9 @@ func TestManifestDownloadStopsAtLimit(t *testing.T) {
 				[]string{cmd.Name, server.URL + "/index.mf"})
 		})
 		require.ErrorIs(t, err, errManifestTooLarge, cmd.Name)
-		require.ErrorContains(t, err,
-			"maximum allowed size of 65536 bytes", cmd.Name)
+		require.EqualError(t, err,
+			"download manifest: file exceeds maximum allowed size of 65536 bytes",
+			cmd.Name)
 	}
 
 	leftover, err := os.ReadDir(tmpDir)
@@ -605,27 +606,27 @@ func TestFetchRefusesSymlinks(t *testing.T) {
 	}{
 		{
 			"parent directory", "sub/deeper/file.txt", "sub", ".",
-			"failed to download sub/deeper/file.txt",
+			"download sub/deeper/file.txt",
 		},
 		{
 			"directory inside a plain directory", "docs/data/passwd", "docs/data", ".",
-			"failed to download docs/data/passwd",
+			"download docs/data/passwd",
 		},
 		{
 			"temp file", testFileTxt, ".file.txt.tmp", newFile,
-			"failed to download " + testFileTxt,
+			"download " + testFileTxt,
 		},
 		{
 			"file", testFileTxt, testFileTxt, newFile,
-			"failed to download " + testFileTxt,
+			"download " + testFileTxt,
 		},
 		{
 			"manifest temp file", testFileTxt, tempPathFor(defaultManifestName), newFile,
-			"failed to save manifest",
+			"save manifest",
 		},
 		{
 			"manifest", testFileTxt, defaultManifestName, newFile,
-			"failed to save manifest",
+			"save manifest",
 		},
 	}
 
@@ -692,7 +693,7 @@ func TestFetchDoesNotSkipThroughSymlink(t *testing.T) {
 	}, afero.NewOsFs())
 	assert.Equal(t, 1, runCLI(opts))
 	assert.Contains(t, testStderr(t, opts),
-		"failed to download sub/"+testFileTxt+": symlink in path not allowed: "+link)
+		"download sub/"+testFileTxt+": symlink in path not allowed: "+link)
 	assert.Equal(t, map[string][]byte{testFileTxt: content}, filesUnder(t, outside))
 }
 
@@ -762,7 +763,8 @@ func TestGetRetriesTransientStatusesOnly(t *testing.T) {
 
 			err := getNothing(testClient(), server.URL, 10*time.Second)
 			require.ErrorIs(t, err, errHTTPStatus)
-			require.EqualError(t, err, fmt.Sprintf("HTTP %d", tt.status))
+			require.EqualError(t, err,
+				fmt.Sprintf("unexpected HTTP status %d", tt.status))
 			assert.Equal(t, tt.requests, requests.Load())
 		})
 	}
@@ -1228,7 +1230,7 @@ func TestFetchRequireSignature(t *testing.T) {
 		manifest, required := manifestSignedByAnotherKey(t, files)
 
 		assertFetchRefused(t, manifest, files,
-			"failed to parse manifest: signature verification failed: "+
+			"parse manifest: "+
 				"embedded public key block must hold exactly one key, found 2",
 			"--"+flagRequireSignature, required)
 	})