Make error message wording consistent (closes #165)

Error messages in mfer/ and internal/cli/ are lowercase except names and
acronyms, carry no "failed to" or command-name prefix, and each wrap names
only the operation and thing the wrapped error does not already name, so a
stacked message names what failed once. Wraps around errors that already
name their operation and path (os and afero path errors, url.Error, the gpg
helpers' own errors) are dropped. runGPG appends gpg's stderr only when gpg
wrote some, so no message ends in a colon. errHTTPStatus reads "unexpected
HTTP status"; both inner-not-set sentinels read "inner message not set".
No sentinel, errors.Is result or exit status changes. Message tests pin the
new text through the real call sites.

Model: opus-5-5

internal/cli/check.go

@@ -108,7 +108,7 @@ func (mfa *CLIApp) fetchManifestToTemp(
 	if tmpErr != nil {
 		_ = rc.Close()
 
-		return "", fmt.Errorf("failed to create temp file: %w", tmpErr)
+		return "", tmpErr
 	}
 
 	tmpPath := tmpFile.Name()
@@ -126,7 +126,7 @@ func (mfa *CLIApp) fetchManifestToTemp(
 	if cpErr != nil {
 		_ = mfa.Fs.Remove(tmpPath)
 
-		return "", fmt.Errorf("failed to download manifest: %w", cpErr)
+		return "", fmt.Errorf("download manifest: %w", cpErr)
 	}
 
 	return tmpPath, nil
@@ -142,7 +142,7 @@ func verifyRequiredSigner(chk *mfer.Checker, requiredSigner string) error {
 
 	_, err := hex.DecodeString(requiredSigner)
 	if err != nil {
-		return fmt.Errorf("invalid fingerprint: must be valid hex: %w", err)
+		return fmt.Errorf("invalid fingerprint: %w", err)
 	}
 
 	if !chk.IsSigned() {
@@ -232,7 +232,7 @@ func findExtraFiles(
 
 	err := chk.FindExtraFiles(ctx, extraResults)
 	if err != nil {
-		return fmt.Errorf("failed to check for extra files: %w", err)
+		return fmt.Errorf("find extra files: %w", err)
 	}
 
 	<-extraDone
@@ -275,7 +275,7 @@ func runCheck(
 	progressWg.Wait()
 
 	if err != nil {
-		return 0, fmt.Errorf("check failed: %w", err)
+		return 0, fmt.Errorf("check files: %w", err)
 	}
 
 	// Wait for results processing to complete
@@ -296,14 +296,14 @@ func (mfa *CLIApp) checkManifestOperation(
 
 	manifestPath, err := mfa.resolveManifestArg(cmd)
 	if err != nil {
-		return fmt.Errorf("check: %w", err)
+		return err
 	}
 
 	// URL manifests need to be downloaded to a temp file for the checker
 	if isHTTPURL(manifestPath) {
 		tmpPath, tmpErr := mfa.fetchManifestToTemp(ctx, manifestPath)
 		if tmpErr != nil {
-			return fmt.Errorf("check: %w", tmpErr)
+			return tmpErr
 		}
 
 		defer func() { _ = mfa.Fs.Remove(tmpPath) }()
@@ -324,7 +324,7 @@ func (mfa *CLIApp) checkManifestOperation(
 		Fs:           mfa.Fs,
 	})
 	if err != nil {
-		return fmt.Errorf("failed to load manifest: %w", err)
+		return fmt.Errorf("load manifest: %w", err)
 	}
 
 	// Check signature requirement