Pin CLI error messages by driving their real call sites (closes #87)

errmsg_test.go now invokes the functions that actually emit each
user-visible message (findManifest, verifyRequiredSigner,
collectInputPaths, generateManifestOperation, openManifestReader,
fetchManifestOperation, downloadFile, finishDownload, sanitizePath,
verifyDownloadedHash) and asserts on what they return. No production
format string is restated in the test, so rewording a message now
fails the suite instead of passing against a copied literal.

The signer-mismatch message needs a signed manifest, so it is driven
against one signed by a throwaway gpg key and skipped where gpg is
absent, as the repo's other signing tests are.

Freshen's mtime-presence test now gives the scanned file an epoch
mtime, so an absent manifest mtime misread as the epoch is
distinguishable and the test fails if recordEntry's nil guard is
dropped.

Model: opus-4-8

internal/cli/freshen_test.go

@@ -110,7 +110,10 @@ func TestFreshenRecordEntryMtimePresence(t *testing.T) {
 
 	const relPath = "file1.txt"
 
-	mtime := time.Unix(1_700_000_000, 0)
+	// The scanned file's mtime is the Unix epoch. If recordEntry ever misreads
+	// an absent manifest mtime as the epoch, the "absent" case below would
+	// compare equal to this and be classified unchanged, so the test fails.
+	mtime := time.Unix(0, 0)
 	info := stubFileInfo{size: 8, mtime: mtime}
 
 	for _, tc := range []struct {