Hold runMu in internal/cli tests that log outside a CLI run (closes #210)

A CLI run under runMu points the process-global logger at its own
buffers, so a line another test logged outside runMu could land in that
run's output. TestCheckQuietShowsFailedFiles caught one: a "loaded
manifest" line in the stderr of a passing check -q run.

The test helpers that scan or load a manifest now hold runMu
themselves, and so do the remaining direct loads and scans, the
recordEntry call and the retrying download. Two dotfile tests use
manifestPaths instead of loading the manifest themselves.

Judgement call: a downloadFile call that gets its answer on the first
request does not log, so those calls are left as they are.

Model: opus-5-5

internal/cli/entry_test.go

@@ -58,10 +58,9 @@ func runCLI(opts *RunOptions) int {
 // runCLIWithLevel is runCLI that also returns the log level the run left
 // set, read while runMu still keeps other runs from changing it. Each run
 // starts at the default level, as a new process does. Before releasing the
-// lock it points the process-global logger at io.Discard: test helpers also
-// log under runMu outside any run (manifest loads, scans), and those lines
-// must not land in this run's buffers once it has returned and its test is
-// reading them.
+// lock it points the process-global logger at io.Discard: other tests log
+// outside the lock (manifest loads, scans), and those lines must not land in
+// this run's buffers once it has returned and its test is reading them.
 func runCLIWithLevel(opts *RunOptions) (int, log.Level) {
 	runMu.Lock()
 	defer runMu.Unlock()
@@ -207,13 +206,13 @@ func TestVersionFlagAndCommandMatch(t *testing.T) {
 
 // TestRootVerbosityFlags asserts that -q and -v given before any subcommand
 // name take effect: in the root itself, and in the fetch and export
-// subcommands (issue #64).
+// subcommands (issue #64). It does not run in parallel: other tests log
+// outside runMu (manifest loads, scans), and a line logged while one of these
+// runs is in progress lands in its output.
+//
+//nolint:paralleltest // see above
 func TestRootVerbosityFlags(t *testing.T) {
-	t.Parallel()
-
 	t.Run("quiet with no subcommand hides the banner", func(t *testing.T) {
-		t.Parallel()
-
 		loud := testOpts([]string{testApp}, afero.NewMemMapFs())
 		require.Equal(t, 0, runCLI(loud))
 		assert.Contains(t, testStdout(t, loud), banner)
@@ -225,8 +224,6 @@ func TestRootVerbosityFlags(t *testing.T) {
 	})
 
 	t.Run("quiet before fetch hides the banner", func(t *testing.T) {
-		t.Parallel()
-
 		opts := testOpts([]string{testApp, "-q", cmdFetch}, afero.NewMemMapFs())
 
 		assert.Equal(t, 1, runCLI(opts))
@@ -235,8 +232,6 @@ func TestRootVerbosityFlags(t *testing.T) {
 	})
 
 	t.Run("verbose twice before fetch enables debug logging", func(t *testing.T) {
-		t.Parallel()
-
 		opts := testOpts([]string{testApp, "-v", "-v", cmdFetch}, afero.NewMemMapFs())
 
 		assert.Equal(t, 1, runCLI(opts))
@@ -244,8 +239,6 @@ func TestRootVerbosityFlags(t *testing.T) {
 	})
 
 	t.Run("quiet before export hides the manifest summary", func(t *testing.T) {
-		t.Parallel()
-
 		fs := afero.NewMemMapFs()
 		manifest := buildTestManifest(t, map[string][]byte{"a.txt": []byte("a")})
 		require.NoError(t, afero.WriteFile(fs, testManifest, manifest, 0o644))