cmd: CLI integration tests + gate-refusal coverage (M1)

cmd/incredigo 4.3% -> 34.5%. Extract newRootCmd() as a testability seam so tests
drive the real wired CLI (persistent flags + every subcommand) via SetArgs.

main_test.go: a runCLI harness that captures os.Stdout/os.Stderr around Execute,
plus a fake gopass on PATH + fixture HOME so no command touches the user's real
store or host dotfiles (discovery isolated to --source file). Covers the safety-
critical contracts: rotate --execute refused without INCREDIGO_ALLOW_EXECUTE=1;
backup gate aborts BEFORE any driver runs when the snapshot fails; empty
passphrase rejected with no sealed content left behind; export refuses to
overwrite; unknown sealer rejected. Plus scan/status/worklist happy paths,
migrate --dedupe, and an export -> import round-trip proving byte-exact restore
with no plaintext in the sealed bundle.

discover: add ClearPaths() to reset the file scanner's process-global --path
targets between CLI invocations (a test-binary need; the one-shot CLI never hits
the stale-target accumulation).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/discover/file.go

@@ -29,6 +29,12 @@ func AddPath(p string) {
 	}
 }
 
+// ClearPaths drops all registered --path targets. The CLI is one-shot so it never
+// needs this, but a long-lived process (notably a test binary invoking the CLI many
+// times) must reset between runs or the singleton accumulates stale, since-removed
+// paths and the scanner errors on the first vanished target.
+func ClearPaths() { fileSingleton.targets = nil }
+
 // fileScanner harvests whole files as credentials from user-supplied paths. Unlike
 // the format-specific scanners (aws, env, …), it does no field parsing: each
 // regular, non-empty, reasonably-sized file becomes ONE Credential whose secret is