check always warns about files the manifest does not list (closes #103)

check now always looks under the base directory for files the manifest
does not list, hidden files and directories included, and prints one
warning per file. The result still depends only on the listed files;
--no-extra-files turns each unlisted file into a failure, and --quiet
hides the warnings but not the failures. A directory that cannot be
listed is reported the same way, and the search goes on past it.

The manifest itself is left out by file identity, as gen and freshen
do; a symlink under the base is compared by what it points to. A base
directory named through a symlink is resolved before the search.

Model: opus-5-5

internal/cli/check.go

@@ -206,16 +206,21 @@ func countCheckFailures(
 }
 
 // findExtraFiles reports files present on disk but absent from the
-// manifest, counting each as a failure.
+// manifest, and anything the search cannot read: each is a failure under
+// --no-extra-files, otherwise a warning.
 func findExtraFiles(ctx *cli.Context, chk *mfer.Checker, failures *int64) error {
 	extraResults := make(chan mfer.Result, 1)
 	extraDone := make(chan struct{})
 
 	go func() {
 		for result := range extraResults {
-			*failures++
+			if ctx.Bool("no-extra-files") {
+				*failures++
 
-			log.Infof("%s: %s (%s)", result.Status, result.Path, result.Message)
+				log.Infof("%s: %s (%s)", result.Status, result.Path, result.Message)
+			} else {
+				log.Warnf("%s: %s (%s)", result.Status, result.Path, result.Message)
+			}
 		}
 
 		close(extraDone)
@@ -270,12 +275,9 @@ func runCheck(ctx *cli.Context, chk *mfer.Checker, showProgress bool) (int64, er
 	// Wait for results processing to complete
 	<-done
 
-	// Check for extra files if requested
-	if ctx.Bool("no-extra-files") {
-		err = findExtraFiles(ctx, chk, &failures)
-		if err != nil {
-			return 0, err
-		}
+	err = findExtraFiles(ctx, chk, &failures)
+	if err != nil {
+		return 0, err
 	}
 
 	return failures, nil