retrofit data witness

Witness reference-data records: bind their bytes to the oplog.

The verb appends one WitnessReferenceData entry per selected record,
carrying the record's digest over every file at its key
{table, label-set, anchor}. A witnessed record whose anchor a seal covers is
verified by validate, op seal, migrate and snapshot.

With no operands it selects every purpose=ref record under data_root whose
anchor is in the unsealed tail and which has no witness at its current bytes.
Operands name record files; a directory is refused. A named record outside the
selection is refused (witness-band, sealed-anchor); one already witnessed at
its current bytes is reported already-witnessed.

--dry-run renders the same rows and appends nothing.

Usage:
  retrofit data witness [path...] [flags]

Flags:
      --dry-run         render the rows the run would produce and append nothing
  -h, --help            help for witness
      --help-all        show extended help (vocabulary, semantics, caveats)
      --schema <name>   registered schema <name> (resolves via the chain when omitted)

Global Flags:
      --as string        output mode: text | json (default "text")
  -C, --chdir string     treat <dir> as the working directory for the entire run
      --config string    retrofit.toml path (overrides discovery; also accepts $RETROFIT_CONFIG)
  -f, --file string      oplog file path; selects a registered [[schema]] path (overrides discovery)
      --no-consolidate   render every advisory occurrence instead of collapsing repeats
  -q, --quiet count      suppress the advisory tier on stderr; stack (-qq) to drop it whole (errors and results still print)
  -v, --verbose          reveal info-tier advisories on stderr

Docs: https://docs.retrofit.sh/current/commands/retrofit-data-witness/