Exit 130 and say so when a command is interrupted (closes #267)

Ctrl-C or SIGTERM during snapshot create, restore or verify exited 0
with no error line (1, also silent, under snapshot verify --json), so
an unfinished --cron backup looked like a success. RunOperation now
records whether op returned while the Vaultik context was still live;
a run where it had not by the time RunWithApp returned is interrupted,
whatever op returned. It used to look for context.Canceled in op's
error, which verify --json does not return. Entry prints "interrupted
before the command finished" on stderr for it and returns 130, under
--cron and --json too.

SIGTERM also gives 130, as the issue asks, not 143.
The test does not cover an op still running when the 30s shutdown
timeout ends.

Model: opus-5-5

internal/cli/app.go

@@ -206,6 +206,10 @@ func RunApp(ctx context.Context, app *fx.App) error {
 // RunOperation through cobra to Entry.
 var errReported = errors.New("operation failed")
 
+// errInterrupted marks an operation that SIGINT or SIGTERM stopped
+// before it finished. Entry shows it and returns exitCodeInterrupted.
+var errInterrupted = errors.New("interrupted before the command finished")
+
 // RunOperation runs op against the Vaultik instance inside the fx app
 // and turns a failure into a returned error rather than an os.Exit from
 // within the goroutine. An os.Exit there skipped main's deferred
@@ -220,17 +224,21 @@ var errReported = errors.New("operation failed")
 // interrupt OnStop cancels op and waits for the goroutine to return, so
 // op's cleanup (removing decrypted scratch files) runs before the
 // process exits; the wait is bounded by shutdownTimeout. report is
-// called with a non-canceled failure so the caller can show it to the
-// user before it becomes errReported. A context cancellation is the
-// interrupt path, not a failure: it is neither reported nor counted as
-// one.
+// called with a failure so the caller can show it to the user before
+// it becomes errReported.
+//
+// The run counts as interrupted unless op returned, without an
+// interrupt having cancelled it, before RunWithApp returned. An
+// interrupted op is not reported, whatever it returned; RunOperation
+// returns errInterrupted instead.
 func RunOperation(
 	ctx context.Context, opts AppOptions,
 	op func(v *vaultik.Vaultik) error, report func(err error),
 ) error {
 	var (
-		mu     sync.Mutex
-		failed bool
+		mu       sync.Mutex
+		finished bool // op returned before any interrupt cancelled it
+		failed   bool // op finished with an error
 	)
 
 	opts.Invokes = append(opts.Invokes,
@@ -241,11 +249,21 @@ func RunOperation(
 				OnStart: func(_ context.Context) error {
 					stop = v.StartOperation(func() {
 						err := op(v)
-						if err != nil && !errors.Is(err, context.Canceled) {
-							report(err)
+
+						// Only stop, called from OnStop below, cancels the
+						// Vaultik context, so a live context means no
+						// interrupt cancelled op. Check the context, not
+						// err: an interrupted op need not return
+						// context.Canceled (`snapshot verify --json`
+						// returns a verification failure).
+						if v.Context().Err() == nil {
+							if err != nil {
+								report(err)
+							}
 
 							mu.Lock()
-							failed = true
+							finished = true
+							failed = err != nil
 							mu.Unlock()
 						}
 
@@ -278,16 +296,23 @@ func RunOperation(
 		return err
 	}
 
-	// The goroutine sets failed before triggering the shutdown that lets
-	// RunWithApp return, so the write is in place by the time we read it.
+	// RunWithApp returns only after the app was asked to stop, either by
+	// an interrupt or by the goroutine's Shutdown call. When op finished
+	// without being cancelled, the goroutine set finished before that
+	// call. So if finished is unset here, an interrupt stopped the app,
+	// and op either returned after it was cancelled or is still running
+	// because the shutdown timed out.
 	mu.Lock()
 	defer mu.Unlock()
 
-	if failed {
+	switch {
+	case !finished:
+		return errInterrupted
+	case failed:
 		return errReported
+	default:
+		return nil
 	}
-
-	return nil
 }
 
 // runVaultikApp runs the standard single-operation command lifecycle