test(12-01): update all tests for explicit key args, add key input tests

- Replace KEY import in golden.rs with local constant
- Replace KEY import in crypto.rs tests with local TEST_KEY constant
- Add --key to all CLI round-trip tests via cmd_with_key() helper
- Add test_key_file_roundtrip: pack/unpack with --key-file
- Add test_rejects_wrong_key: wrong key causes decryption failure
- Add test_rejects_bad_hex: too-short hex produces clear error
- Add test_rejects_missing_key: pack without key arg fails
- Add test_inspect_without_key: shows header only, not TOC
- Add test_inspect_with_key: shows full entry listing
- All 47 tests pass (25 unit + 7 golden + 15 integration)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/crypto.rs

@@ -80,15 +80,22 @@ pub fn sha256_hash(data: &[u8]) -> [u8; 32] {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::key::KEY;
     use hex_literal::hex;
 
+    /// Test key matching legacy hardcoded value
+    const TEST_KEY: [u8; 32] = [
+        0x7A, 0x35, 0xC1, 0xD9, 0x4F, 0xE8, 0x2B, 0x6A,
+        0x91, 0x0D, 0xF3, 0x58, 0xBC, 0x74, 0xA6, 0x1E,
+        0x42, 0x8F, 0xD0, 0x63, 0xE5, 0x17, 0x9B, 0x2C,
+        0xFA, 0x84, 0x06, 0xCD, 0x3E, 0x79, 0xB5, 0x50,
+    ];
+
     #[test]
     fn test_encrypt_decrypt_roundtrip() {
         let plaintext = b"Hello, World!";
         let iv = [0u8; 16];
-        let ciphertext = encrypt_data(plaintext, &KEY, &iv);
-        let decrypted = decrypt_data(&ciphertext, &KEY, &iv).unwrap();
+        let ciphertext = encrypt_data(plaintext, &TEST_KEY, &iv);
+        let decrypted = decrypt_data(&ciphertext, &TEST_KEY, &iv).unwrap();
         assert_eq!(decrypted, plaintext);
     }
 
@@ -96,8 +103,8 @@ mod tests {
     fn test_encrypt_decrypt_empty() {
         let plaintext = b"";
         let iv = [0u8; 16];
-        let ciphertext = encrypt_data(plaintext, &KEY, &iv);
-        let decrypted = decrypt_data(&ciphertext, &KEY, &iv).unwrap();
+        let ciphertext = encrypt_data(plaintext, &TEST_KEY, &iv);
+        let decrypted = decrypt_data(&ciphertext, &TEST_KEY, &iv).unwrap();
         assert_eq!(decrypted, plaintext.as_slice());
     }
 
@@ -105,23 +112,23 @@ mod tests {
     fn test_encrypted_size_formula() {
         let iv = [0u8; 16];
         // 5 bytes -> ((5/16)+1)*16 = 16
-        assert_eq!(encrypt_data(b"Hello", &KEY, &iv).len(), 16);
+        assert_eq!(encrypt_data(b"Hello", &TEST_KEY, &iv).len(), 16);
         // 16 bytes -> ((16/16)+1)*16 = 32 (full padding block)
-        assert_eq!(encrypt_data(&[0u8; 16], &KEY, &iv).len(), 32);
+        assert_eq!(encrypt_data(&[0u8; 16], &TEST_KEY, &iv).len(), 32);
         // 0 bytes -> ((0/16)+1)*16 = 16
-        assert_eq!(encrypt_data(b"", &KEY, &iv).len(), 16);
+        assert_eq!(encrypt_data(b"", &TEST_KEY, &iv).len(), 16);
     }
 
     #[test]
     fn test_hmac_compute_verify() {
         let iv = [0xAA; 16];
         let ciphertext = b"some ciphertext data here!!12345";
-        let hmac_tag = compute_hmac(&KEY, &iv, ciphertext);
+        let hmac_tag = compute_hmac(&TEST_KEY, &iv, ciphertext);
         // Verify with correct tag
-        assert!(verify_hmac(&KEY, &iv, ciphertext, &hmac_tag));
+        assert!(verify_hmac(&TEST_KEY, &iv, ciphertext, &hmac_tag));
         // Verify with wrong tag
         let wrong_tag = [0u8; 32];
-        assert!(!verify_hmac(&KEY, &iv, ciphertext, &wrong_tag));
+        assert!(!verify_hmac(&TEST_KEY, &iv, ciphertext, &wrong_tag));
     }
 
     #[test]