fix: read KEY_ENCRYPTION_KEY in archive-only verify; never leave a partial archive

internal/cmd/root.go

@@ -93,10 +93,16 @@ func resolveGlobals(c *cobra.Command) (*globalOpts, error) {
 	return &globalOpts{
 		MongoURI: uri,
 		Database: db,
-		KeyHex:   strings.TrimSpace(os.Getenv("KEY_ENCRYPTION_KEY")),
+		KeyHex:   keyFromEnv(),
 	}, nil
 }
 
+// keyFromEnv reads KEY_ENCRYPTION_KEY. It is separate from resolveGlobals
+// because verify needs the key even when there is no database to resolve.
+func keyFromEnv() string {
+	return strings.TrimSpace(os.Getenv("KEY_ENCRYPTION_KEY"))
+}
+
 // databaseFromURI reads the database out of the URI path. sitesvc takes its
 // database name this way too, so an operator who has configured one has
 // configured both.