Refuse to freshen a signed manifest without --sign-key (closes #191)

freshen built the new manifest from its flags alone, so a signed
manifest freshened without --sign-key came out unsigned while the log
said its signature verified. freshen now stops after loading such a
manifest, before scanning, with an error naming the signer's
fingerprint and --sign-key, and leaves the manifest as it was. With
--sign-key it rewrites and signs as before.

The library gains Signer() on the loaded manifest: the signing key's
fingerprint, or nil when the manifest is unsigned, as Checker.Signer
gives it.

Model: opus-5-5

internal/cli/check.go

@@ -189,8 +189,8 @@ func reportCheckProgress(progress <-chan mfer.CheckStatus, wg *sync.WaitGroup) {
 	log.ProgressDone()
 }
 
-// countCheckFailures consumes check results, counting and logging
-// failures, then closes done.
+// countCheckFailures consumes check results, counting failures and logging
+// each at error level so that --quiet still shows them, then closes done.
 func countCheckFailures(
 	results <-chan mfer.Result, failures *int64, done chan<- struct{},
 ) {
@@ -198,7 +198,7 @@ func countCheckFailures(
 		if result.Status != mfer.StatusOK {
 			*failures++
 
-			log.Infof("%s: %s (%s)", result.Status, result.Path, result.Message)
+			log.Errorf("%s: %s (%s)", result.Status, result.Path, result.Message)
 		} else {
 			log.Verbosef("%s: %s", result.Status, result.Path)
 		}
@@ -208,8 +208,8 @@ func countCheckFailures(
 }
 
 // findExtraFiles reports files present on disk but absent from the
-// manifest, and anything the search cannot read: each is a failure under
-// --no-extra-files, otherwise a warning.
+// manifest, and anything the search cannot read: each is a failure, logged
+// at error level, under --no-extra-files, otherwise a warning.
 func findExtraFiles(
 	ctx context.Context, cmd *cli.Command, chk *mfer.Checker, failures *int64,
 ) error {
@@ -221,7 +221,7 @@ func findExtraFiles(
 			if cmd.Bool("no-extra-files") {
 				*failures++
 
-				log.Infof("%s: %s (%s)", result.Status, result.Path, result.Message)
+				log.Errorf("%s: %s (%s)", result.Status, result.Path, result.Message)
 			} else {
 				log.Warnf("%s: %s (%s)", result.Status, result.Path, result.Message)
 			}

internal/cli/entry_test.go

@@ -694,6 +694,33 @@ func TestCheckCommandWithSizeMismatch(t *testing.T) {
 		"check should have failed for size mismatch")
 }
 
+// TestCheckQuietShowsFailedFiles asserts that check -q prints nothing for a
+// tree that passes and still names each file that fails: --quiet hides
+// everything except errors, and a failed file is an error.
+func TestCheckQuietShowsFailedFiles(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	require.NoError(t, fs.MkdirAll(testDir, 0o755))
+	writeTestFile(t, fs, testFile1, "hello world")
+
+	opts := testOpts([]string{testApp, cmdGenerate, "-q", "-o", testManifest, testDir}, fs)
+	require.Equal(t, 0, runCLI(opts), "generate failed: %s", testStderr(t, opts))
+
+	args := []string{testApp, cmdCheck, "-q", testFlagBase, testDir, testManifest}
+
+	opts = testOpts(args, fs)
+	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+	assert.Empty(t, testStdout(t, opts))
+	assert.Empty(t, testStderr(t, opts))
+
+	writeTestFile(t, fs, testFile1, "HELLO WORLD")
+
+	opts = testOpts(args, fs)
+	assert.Equal(t, 1, runCLI(opts))
+	assert.Contains(t, testStderr(t, opts), "HASH_MISMATCH: file1.txt")
+}
+
 func TestBannerOutput(t *testing.T) {
 	t.Parallel()
 
@@ -926,8 +953,9 @@ func TestCheckWarnsAboutUnlistedFiles(t *testing.T) {
 			assert.Equal(t, 1, exitCode, "stderr: %s", stderr)
 			assert.Contains(t, stderr, unlisted)
 
-			exitCode, _ = check("-q", testFlagNoExtra)
+			exitCode, stderr = check("-q", testFlagNoExtra)
 			assert.Equal(t, 1, exitCode)
+			assert.Contains(t, stderr, unlisted)
 		})
 	}
 }