fix: read KEY_ENCRYPTION_KEY in archive-only verify; never leave a partial archive

internal/cmd/verify.go

@@ -31,7 +31,12 @@ func newVerifyCmd() *cobra.Command {
 			}
 			defer archive.Close()
 
-			opt := backup.VerifyOptions{Archive: archive}
+			// The key is read unconditionally. Archive-only mode — no MONGO_URI,
+			// which is what a scheduled check uses — must still compare the key
+			// in hand against the archive's fingerprint; leaving it unset there
+			// reported "KEY_ENCRYPTION_KEY is not set" for a key that was set
+			// and correct.
+			opt := backup.VerifyOptions{Archive: archive, KeyHex: keyFromEnv()}
 
 			// A database is optional here. resolveGlobals fails without a URI or
 			// without a resolvable database name, and either error is a signal to
@@ -45,7 +50,6 @@ func newVerifyCmd() *cobra.Command {
 				defer client.Disconnect(context.Background())
 				opt.Client = client
 				opt.Database = g.Database
-				opt.KeyHex = g.KeyHex
 			} else {
 				fmt.Fprintf(c.ErrOrStderr(),
 					"note: %v, so this checks the archive and the key only\n", gerr)