Report only symlinks to regular files as extra files in check (closes #192)

gen never lists a symlink to a directory or a broken one, and lists a
symlink to a regular file only with --follow-symlinks. check's search for
extra files reported every symlink, so on a tree holding a directory
symlink no manifest gen writes could pass check --no-extra-files. The
search now resolves a symlink and reports an entry only if it is a
regular file, which also covers the pipes, sockets and devices it already
left out. The README's check entry says what is reported.

Judgement call: one regular-file check replaces the separate test for
pipes, sockets and devices, so a file of unknown type is not reported
either; gen does not list one.

Model: opus-5-5

internal/cli/entry_test.go

@@ -960,6 +960,53 @@ func TestCheckWarnsAboutUnlistedFiles(t *testing.T) {
 	}
 }
 
+// TestCheckReportsUnlistedSymlinkToFileOnly makes a tree holding a symlink
+// to a directory, one to a file and a broken one. gen lists the symlink to
+// the file only with --follow-symlinks, and never lists the other two, so
+// check --no-extra-files passes on the manifest gen --follow-symlinks writes
+// and fails only on the symlink to the file on the one plain gen writes.
+func TestCheckReportsUnlistedSymlinkToFileOnly(t *testing.T) {
+	t.Parallel()
+
+	for name, tc := range map[string]struct {
+		genFlags []string
+		exitCode int
+		extras   []string // what check reports as not in the manifest
+	}{
+		"gen --follow-symlinks": {[]string{"--follow-symlinks"}, 0, nil},
+		"plain gen":             {nil, 1, []string{"filelink"}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			dir := t.TempDir()
+			fs := afero.NewOsFs()
+			writeTestTree(t, fs, dir)
+			require.NoError(t, os.Symlink(testSubdir, filepath.Join(dir, "dirlink")))
+			require.NoError(t, os.Symlink(testFileTxt, filepath.Join(dir, "filelink")))
+			require.NoError(t,
+				os.Symlink("nowhere", filepath.Join(dir, "brokenlink")))
+
+			opts := testOpts(slices.Concat(
+				[]string{testApp, cmdGenerate, "-q"}, tc.genFlags, []string{dir},
+			), fs)
+			require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+			opts = testOpts([]string{testApp, cmdCheck, testFlagNoExtra, dir}, fs)
+			exitCode := runCLI(opts)
+			stderr := testStderr(t, opts)
+
+			assert.Equal(t, tc.exitCode, exitCode, "stderr: %s", stderr)
+			assert.Equal(t, len(tc.extras),
+				strings.Count(stderr, "not in manifest"), stderr)
+
+			for _, extra := range tc.extras {
+				assert.Contains(t, stderr, "EXTRA: "+extra)
+			}
+		})
+	}
+}
+
 // TestCheckNeverReportsManifest keeps the manifest inside the checked tree,
 // under several names and path spellings, and names the tree both directly
 // and through a symlink: the manifest is never reported, even under