cmd/fsck: `--ui=false` Exits 0 on Corrupted Logs

[discovered w/ the help of Claude]

Problem

fsck --ui=false always exits 0 even on corruption, discarding errors before they reach $?. In 2 of 3 failure modes, no diagnostic is printed, making --ui=false unusable as an automated CI/pipeline gate.

Impact Matrix (Fault Injection on Static-CT Log)

Underlying detection logic in tessera/fsck is sound; only cmd/fsck error reporting fails.

Root Causes

1. Early Return Bypasses eg.Wait() (main.go:92–101):
   f.Check completion invokes deferred cancel(), closing ctx.Done(). The non-TUI loop executes case <-ctx.Done(): return, exiting main directly and skipping eg.Wait(), os.Exit(1), and slog.Info("OK").
2. Disconnected Issuer Status:
   Successfully fsck'd log (tessera/fsck/fsck.go:167) reflects tree verification only, omitting concurrent checkIssuersTask status.
3. LIFO Defer Prematurely Cancels Context (main.go:76–81):
   defer cancel() runs before defer lsc.Close(), canceling ctx while issuer workers may still be draining issuersToCheck, potentially truncating checks on large logs or causing spurious HTTP context canceled errors.
4. Regression test: No test currently invokes the cmd/fsck binary — all existing fsck coverage calls Check() directly and inspects the returned error, which is why this went unnoticed. Add a test that execs the built binary against a corrupted fixture with --ui=false and asserts a non-zero exit.

Minimal Reproduction

go build -o /tmp/fsck-ct ./cmd/fsck

# Corrupt single byte in a mirrored log tile:
cp -r /path/to/log /tmp/broken
printf '\x01' | dd of=/tmp/broken/tile/0/042 bs=1 seek=100 conv=notrunc

# Run without TUI:
/tmp/fsck-ct --monitoring_url=file:///tmp/broken \
  --origin=<origin> --public_key=<key> --ui=false
echo $?  # Returns 0 with no error diagnostics (BUG)

Start with cmd/fsck/main.go:76–101 and tessera/fsck/fsck.go:167, then build ./cmd/fsck and reproduce the corrupted-log case with --ui=false. Add a test that executes the fsck binary against a corrupted fixture and verifies diagnostics plus a non-zero exit; done also requires issuer checks to be included without premature cancellation.