check always warns about files the manifest does not list (closes #103)

check now always looks under the base directory for files the manifest
does not list, hidden files and directories included, and prints one
warning per file. The result still depends only on the listed files;
--no-extra-files turns each unlisted file into a failure, and --quiet
hides the warnings but not the failures. A directory that cannot be
searched is likewise only a warning unless that flag is given.

The manifest itself is left out by file identity, as gen and freshen
do, so no name or spelling of its path or of the base gets it reported.

Model: opus-5-5

internal/cli/mfer.go

@@ -227,7 +227,7 @@ func (mfa *CLIApp) checkCommand() *cli.Command {
 			},
 			&cli.BoolFlag{
 				Name:  "no-extra-files",
-				Usage: "Fail if files exist in base directory that are not in manifest",
+				Usage: "Fail, instead of warning, if files in base directory are not in manifest",
 			},
 			&cli.StringFlag{
 				Name:    "require-signature",