fix: treat seal Ctrl-C as quiet interrupt, not false Unsealed (Bugbot #397)

[shujaatTracebloc]

Resolves a Cursor Bugbot finding on the cli promotion PR (#397, develop → main).

Seal Ctrl-C can fake Unsealed (Medium) — the seal check's mid-suite cancel detection looked only at ctx.Err(). On a terminal Ctrl-C the helm child can exit 130 (128+SIGINT) before NotifyContext flips the context — the same race installerRunInterrupted already covers for upgrade / prepare-host. In that window the failed helm call was read as a real check failure and rendered a false Unsealed (exit 2) instead of a quiet interrupt (exit 130), breaking the seal check's "never claim a verdict you didn't verify" rule.

Fix: reuse the existing installerRunInterrupted(ctx, err) helper (generalized in #402, merged into develop) at the seal cancel sites — no duplicated logic. It checks ctx.Err() first (preserving existing behavior) then the child's exit-130, so a Ctrl-C is treated as a quiet interrupt and no verdict is printed. Applied at both cancel sites in internal/cli/seal.go: the cited mid-suite per-check loop and the sibling hook-enumeration path, which has the identical race.

helm.Runner returns exec.CommandContext(...).CombinedOutput()'s error unwrapped, so errors.As in the helper finds the *exec.ExitError and reads code 130.

Adds TestSeal_CtrlCExit130BeforeCtxFlips_NoFalseUnsealed, which fails on the old code (exit 2, false Unsealed) and passes with the fix (exit 130, no verdict). Existing cancel tests (which set ctx.Err()) are unchanged and still pass.

(#397 (comment))

Lands on develop; the promotion PR head picks it up on the next sync and Bugbot re-reviews.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to interrupt detection on the seal path; reuses an existing helper and adds regression coverage with no auth or data-handling impact.

Overview
Fixes a Ctrl-C race in tracebloc client status --seal where helm could return exit 130 before NotifyContext set ctx.Err(), so a cancelled run was treated as a failed conformance check and printed a false Unsealed (exit 2) instead of a quiet interrupt (exit 130).

internal/cli/seal.go now calls the shared installerRunInterrupted(ctx, err) helper (same as upgrade/prepare-host) at both interrupt boundaries: hook enumeration and each per-check helm run. Cancelled runs still exit exitInterrupted with no verdict.

Adds TestSeal_CtrlCExit130BeforeCtxFlips_NoFalseUnsealed, which simulates a real *exec.ExitError with code 130 while the context stays active, and asserts exit 130, silent error, and no Sealed/Unsealed output.

^{Reviewed by Cursor Bugbot for commit 65659f1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

Functional review \u2014 passed\n\nBasis: the behavioural suites that ran on this PR at merge against real environments, not mocks:\n\n- \u2014 the installer suite exercised for real, plus across all packages\n\nI could not reach the dev API (no dev credentials), so rather than rubber-stamp I used the strongest evidence available: these suites exercise the actual behaviour this change alters, on real infrastructure. Advancing \u2192 .\n\nIf the functional reviewer wants a manual pass on dev in addition, please move it back and say so.