fetch: destination directory, skip files already present, save the manifest, require a signer (closes #101)

fetch takes --dest (default .) and writes every file there through the
existing symlink and hard-link guards, which now work relative to that
directory. A file already there with the listed size and hash is
skipped; a leftover temp file is still replaced. Once every file
verifies, the manifest is saved as index.mf through the same temp file
and rename, so check runs on the result. --require-signature is shared
with check and enforced through verifyRequiredSigner, on a Checker over
the manifest held in memory, before anything is downloaded or written.

Model: opus-5-5

internal/cli/mfer.go

@@ -22,8 +22,10 @@ const (
 	cmdFetch    = "fetch"
 	cmdVersion  = "version"
 
-	flagProgress = "progress"
-	flagTimeout  = "timeout"
+	flagProgress         = "progress"
+	flagTimeout          = "timeout"
+	flagDest             = "dest"
+	flagRequireSignature = "require-signature"
 
 	manifestArgsUsage = "[manifest file]"
 
@@ -142,6 +144,17 @@ func commonFlags() []cli.Flag {
 	}
 }
 
+// requireSignatureFlag returns the --require-signature flag taken by the
+// check and fetch subcommands.
+func requireSignatureFlag() *cli.StringFlag {
+	return &cli.StringFlag{
+		Name:    flagRequireSignature,
+		Aliases: []string{"S"},
+		Usage:   "Require manifest to be signed by the specified GPG key ID",
+		EnvVars: []string{"MFER_REQUIRE_SIGNATURE"},
+	}
+}
+
 func (mfa *CLIApp) generateCommand() *cli.Command {
 	return &cli.Command{
 		Name:      cmdGenerate,
@@ -229,12 +242,7 @@ func (mfa *CLIApp) checkCommand() *cli.Command {
 				Name:  "no-extra-files",
 				Usage: "Fail if files exist in base directory that are not in manifest",
 			},
-			&cli.StringFlag{
-				Name:    "require-signature",
-				Aliases: []string{"S"},
-				Usage:   "Require manifest to be signed by the specified GPG key ID",
-				EnvVars: []string{"MFER_REQUIRE_SIGNATURE"},
-			},
+			requireSignatureFlag(),
 		),
 	}
 }
@@ -354,6 +362,13 @@ func (mfa *CLIApp) fetchCommand() *cli.Command {
 				Usage: "Time limit for each HTTP request, including the download " +
 					"of its body",
 			},
+			&cli.StringFlag{
+				Name:    flagDest,
+				Aliases: []string{"d"},
+				Value:   ".",
+				Usage:   "Directory to download the files and the manifest into",
+			},
+			requireSignatureFlag(),
 		),
 	}
 }