fix(cli): upgrade error hints recommend UTEKE_UPGRADE_SKIP_CHECKSUM=1, which now also disables signature verification #1475

Found while reviewing commit 09fb50b (feat(cli): verify a minisign signature in uteke upgrade (#1327)) with an agent-driven cora review; validated by reading crates/uteke-cli/src/commands/upgrade.rs. Low severity: the verification itself looks sound (fails closed, binds the signed comment to the tag, rejects legacy signatures, downgrades and pre-release tags, and checks before the archive download).

Problem

Three error paths tell the user to set UTEKE_UPGRADE_SKIP_CHECKSUM=1 to proceed:

• upgrade.rs:170 (checksums download failed): "Set UTEKE_UPGRADE_SKIP_CHECKSUM=1 to skip."
• upgrade.rs:178 (HTTP error on checksums): "... Set UTEKE_UPGRADE_SKIP_CHECKSUM=1 to bypass."
• upgrade.rs:718 (checksum for the archive not found): "... Set UTEKE_UPGRADE_SKIP_CHECKSUM=1 to bypass."

Since #1462 that variable skips the archive hash and the minisign signature check. An ordinary, possibly transient failure (a GitHub 5xx, a rate limit, a missing asset) now suggests dropping the whole verification chain, so a user who copy-pastes the hint downloads and executes an unverified binary. The [WARN] block printed once the variable is set is explicit about this, but it only appears after the user has already followed the hint.

Suggestion

Make the hints say what the variable now does ("also disables minisign signature verification"), or better point to the manual-verification help (SIGNATURE_HELP) and retry guidance instead of the bypass, and keep the bypass documented in SECURITY.md only.

Done when

No error message recommends UTEKE_UPGRADE_SKIP_CHECKSUM=1 without stating that it also disables signature verification (or they point to manual verification instead); a test pins the wording.