retrofit op unseal

Demote the most-recent N Seal record(s), keeping their ops as unsealed tail

Usage:
  retrofit op unseal [N] [flags]

Flags:
      --dry-run    preview the Seal opids that would be removed without writing
  -h, --help       help for unseal
      --help-all   show extended help (vocabulary, semantics, caveats)

Global Flags:
      --as string        output mode: text | json (default "text")
  -C, --chdir string     treat <dir> as the working directory for the entire run
      --config string    retrofit.toml path (overrides discovery; also accepts $RETROFIT_CONFIG)
  -f, --file string      oplog file path; selects a registered [[schema]] path (overrides discovery)
      --no-consolidate   render every advisory occurrence instead of collapsing repeats
  -q, --quiet count      suppress the advisory tier on stderr; stack (-qq) to drop it whole (errors and results still print)
      --schema <name>    registered schema <name> (resolves via the chain when omitted)
  -v, --verbose          reveal info-tier advisories on stderr

Docs: https://docs.retrofit.sh/current/commands/retrofit-op-unseal/

Extended help:

Unseal vs truncate:

  `op unseal N` removes the N most-recent Seal records but keeps
  every op they covered, returning those ops to the unsealed tail. The
  next `op seal` seals the whole unsealed tail, these ops
  included, under a new opid.

  `op truncate --drop-seals N` removes the seals and the ops they
  cover (rewind/destroy). Use unseal when you sealed too early and want
  to keep the ops; use truncate when you want them gone.

  Unseal works on the tail only: it peels the newest seal(s). Unsealing
  a middle seal would orphan a newer seal's attestation, so only the
  most-recent records are eligible. When there are no seals this is a guarded no-op
  (exit 0, the file is left byte-identical).

  Removing a Seal reopens previously-attested history; the command is the
  attestation, so it takes no flag and reports each Seal it removed.