rework -C (perfect candidate for using hash tables, really):

insert files we want to check into a hash,
parse SHA256 message on the fly, delete entries whose checksum match,
then display entries that failed.

This completely avoids allocating temporary storage for file names and checksums
and removes the quadratic match (argv[i] vs line[n]).

okay tedu@
checksum mode can use magic pubkey finder too
a few changes for new code to match local style
save up the failures for the end in the argc == 0.
help ok espie