Make error message wording consistent (closes #165)

Error messages in mfer/ and internal/cli/ are lowercase except names and
acronyms, carry no "failed to" or command-name prefix, and each wrap names
only the operation and thing the wrapped error does not already name, so a
stacked message names what failed once. Wraps around errors that already
name their operation and path (os and afero path errors, url.Error, the
builder's path errors, the gpg helpers' own errors) are dropped. gpg's
stderr is appended to a gpg failure, and to the error for a signing key gpg
did not report, only when gpg wrote some. errHTTPStatus reads "unexpected
HTTP status"; both inner-not-set sentinels read "inner message not set".
No sentinel, errors.Is result or exit status changes.

Model: opus-5-5

internal/cli/entry_test.go

@@ -382,7 +382,7 @@ func TestGenerateRefusesTwoFilesAtOnePath(t *testing.T) {
 			}, fs)
 			assert.Equal(t, 1, runCLI(opts))
 			assert.Contains(t, testStderr(t, opts),
-				`generate: failed to enumerate paths: duplicate path "a.txt": `+
+				`enumerate files: duplicate path "a.txt": `+
 					tc.first+"/a.txt and "+tc.second+"/a.txt")
 
 			exists, err := afero.Exists(fs, testOutput)
@@ -674,7 +674,7 @@ func TestCheckRequireSignatureRefusesOtherSigningKey(t *testing.T) {
 	}, fs)
 	assert.Equal(t, 1, runCLI(opts))
 	assert.Contains(t, testStderr(t, opts),
-		"failed to load manifest: signature verification failed: "+
+		"load manifest: "+
 			"embedded public key block must hold exactly one key, found 2")
 }