Fix config-not-found errors, dev-build hint, unify output writer

ResolveConfigPath now stats explicit paths from --config and
$VAULTIK_CONFIG and produces an actionable error naming the bad
path and suggesting 'vaultik config init' (with the right path
in the --config case). The default-search failure message lists
the paths it tried.

The scanner no longer hard-codes os.Stdout vs io.Discard based on
EnableProgress. ScannerConfig and ScannerParams take an explicit
Output io.Writer, and the Vaultik caller passes v.Stdout — which
itself is set to io.Discard in --cron mode. One knob controls
both scanner-level and Vaultik-level user-facing output.

The version command prints a hint when Version == "dev" telling
the user this is a development build without embedded version
metadata.

internal/cli/root.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/adrg/xdg"
 	"github.com/spf13/cobra"
@@ -63,13 +64,21 @@ func GetRootFlags() RootFlags {
 
 // ResolveConfigPath resolves the config file path from flags, environment, or default.
 // Search order: --config flag, VAULTIK_CONFIG env, XDG config dir, /etc/vaultik/config.yml.
+// Explicit paths from --config and $VAULTIK_CONFIG are checked for existence
+// so the user gets a clear error instead of a downstream YAML parser failure.
 func ResolveConfigPath() (string, error) {
-	if rootFlags.ConfigPath != "" {
-		return rootFlags.ConfigPath, nil
+	if path := rootFlags.ConfigPath; path != "" {
+		if _, err := os.Stat(path); err != nil {
+			return "", fmt.Errorf("config file from --config not found: %s (run 'vaultik config init --config %s' to create it)", path, path)
+		}
+		return path, nil
 	}
 
-	if envPath := os.Getenv("VAULTIK_CONFIG"); envPath != "" {
-		return envPath, nil
+	if path := os.Getenv("VAULTIK_CONFIG"); path != "" {
+		if _, err := os.Stat(path); err != nil {
+			return "", fmt.Errorf("config file from $VAULTIK_CONFIG not found: %s (unset VAULTIK_CONFIG, point it at an existing file, or run 'vaultik config init')", path)
+		}
+		return path, nil
 	}
 
 	for _, path := range defaultConfigPaths() {
@@ -78,7 +87,7 @@ func ResolveConfigPath() (string, error) {
 		}
 	}
 
-	return "", fmt.Errorf("no config file found; run 'vaultik config init' to create one, or specify with --config")
+	return "", fmt.Errorf("no config file found at %s (run 'vaultik config init' to create the default config, or pass --config <path>)", strings.Join(defaultConfigPaths(), " or "))
 }
 
 // defaultConfigPaths returns the ordered list of config paths to search.

internal/cli/version.go

@@ -20,6 +20,12 @@ func NewVersionCommand() *cobra.Command {
 			fmt.Printf("  commit:  %s\n", globals.Commit)
 			fmt.Printf("  go:      %s\n", runtime.Version())
 			fmt.Printf("  os/arch: %s/%s\n", runtime.GOOS, runtime.GOARCH)
+			if globals.Version == "dev" {
+				fmt.Println()
+				fmt.Println("This is a development build (no version information embedded).")
+				fmt.Println("Build a release binary with 'make vaultik' or download from")
+				fmt.Println("https://sneak.berlin/go/vaultik for embedded version metadata.")
+			}
 		},
 	}