Exit 130 and say so when a command is interrupted (closes #267)

Ctrl-C or SIGTERM during snapshot create, restore or verify exited 0
with no error line (1, also silent, under snapshot verify --json), so
an unfinished --cron backup looked like a success. RunOperation now
counts an op as interrupted when the Vaultik context was cancelled
before it returned, rather than when its error wraps context.Canceled,
which verify --json does not. Entry prints "interrupted before the
command finished" on stderr for it and returns 130, under --cron and
--json too.

SIGTERM also gives 130, as the issue asks, not 143.
The test does not reach the branch for an op still running when the
30s shutdown timeout ends.

Model: opus-5-5

internal/cli/app.go

@@ -225,20 +225,16 @@ var errInterrupted = errors.New("interrupted before the command finished")
 // op's cleanup (removing decrypted scratch files) runs before the
 // process exits; the wait is bounded by shutdownTimeout. report is
 // called with a failure so the caller can show it to the user before
-// it becomes errReported.
-//
-// The run counts as interrupted unless op returned, without an
-// interrupt having cancelled it, before RunWithApp returned. An
-// interrupted op is not reported, whatever it returned; RunOperation
-// returns errInterrupted instead.
+// it becomes errReported. An interrupted op is not reported, whatever
+// it returned; RunOperation returns errInterrupted instead.
 func RunOperation(
 	ctx context.Context, opts AppOptions,
 	op func(v *vaultik.Vaultik) error, report func(err error),
 ) error {
 	var (
-		mu       sync.Mutex
-		finished bool // op returned before any interrupt cancelled it
-		failed   bool // op finished with an error
+		mu          sync.Mutex
+		failed      bool
+		interrupted bool
 	)
 
 	opts.Invokes = append(opts.Invokes,
@@ -251,19 +247,21 @@ func RunOperation(
 						err := op(v)
 
 						// Only stop, called from OnStop below, cancels the
-						// Vaultik context, so a live context means no
-						// interrupt cancelled op. Check the context, not
-						// err: an interrupted op need not return
+						// Vaultik context; before op has returned, that
+						// happens only on an interrupt. Check the context,
+						// not err: an interrupted op need not return
 						// context.Canceled (`snapshot verify --json`
 						// returns a verification failure).
-						if v.Context().Err() == nil {
-							if err != nil {
-								report(err)
-							}
+						switch {
+						case v.Context().Err() != nil:
+							mu.Lock()
+							interrupted = true
+							mu.Unlock()
+						case err != nil:
+							report(err)
 
 							mu.Lock()
-							finished = true
-							failed = err != nil
+							failed = true
 							mu.Unlock()
 						}
 
@@ -284,6 +282,12 @@ func RunOperation(
 					if !stop(ctx) {
 						log.Warn("Shutdown timed out before the operation " +
 							"finished; decrypted temporary files may remain")
+
+						// op has not returned, so the app is stopping on
+						// an interrupt.
+						mu.Lock()
+						interrupted = true
+						mu.Unlock()
 					}
 
 					return nil
@@ -296,17 +300,16 @@ func RunOperation(
 		return err
 	}
 
-	// RunWithApp returns only after the app was asked to stop, either by
-	// an interrupt or by the goroutine's Shutdown call. When op finished
-	// without being cancelled, the goroutine set finished before that
-	// call. So if finished is unset here, an interrupt stopped the app,
-	// and op either returned after it was cancelled or is still running
-	// because the shutdown timed out.
+	// RunWithApp returns only after OnStop has waited for the goroutine
+	// to return, whether the shutdown came from op finishing or from an
+	// interrupt, so the goroutine's write to failed or interrupted is in
+	// place by the time we read it. If OnStop timed out, the goroutine
+	// may still be running, and OnStop has set interrupted itself.
 	mu.Lock()
 	defer mu.Unlock()
 
 	switch {
-	case !finished:
+	case interrupted:
 		return errInterrupted
 	case failed:
 		return errReported