pub fn load_effective_or_echo<P, F>(loader: F) -> Result<P>Expand description
Wrap a per-service load_effective call with echo-mode arming.
On a signing error (untrusted file, tampered bytes, rotated key,
broken trust store, missing keychain), arm the reason and
return a permissive Default permissions value so the verb’s
check_* calls no-op and the verb’s transport selector can switch
to the buffered dry-run path.
Non-signing errors propagate unchanged. Diagnostic verbs
(permissions show|check|...) bypass this wrapper and call
load_effective directly so signing errors surface there.