feat(keylimectl): add progress spinners and optional color output

Add animated progress spinners using indicatif for long-running
operations (attestation polling, key derivation retry) and optional
color output via console. Spinners auto-detect TTY on stderr and fall
back to plain text when piped. Colors apply to stderr only, keeping
stdout clean for machine consumption.

New --color flag (auto|always|never) controls color output. The
OutputHandler now supports start_wait() which returns an RAII
WaitHandle for polling loops with live status updates.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ansasaki

Cargo.lock

@@ -48,6 +48,8 @@ bzip2 = "0.5"
 zstd = { version = "0.13", default-features = false }
 toml = "0.8"
 zeroize = "1"
+indicatif = "0.17"
+console = "0.15"
 
 [lints.clippy]
 all = "deny"

keylimectl/Cargo.toml

@@ -589,6 +589,10 @@ async fn poll_attestation_status(
     let timeout = std::time::Duration::from_secs(timeout_secs);
     let poll_interval = std::time::Duration::from_secs(2);
 
+    let wait_handle = output.start_wait(format!(
+        "Waiting for attestation of agent {agent_id}..."
+    ));
+
     loop {
         if start.elapsed() > timeout {
             return Err(CommandError::agent_operation_failed(
@@ -647,13 +651,22 @@ async fn poll_attestation_status(
                         );
                     }
                     Some("PASS") => {
+                        drop(wait_handle);
                         output.info(format!(
                             "Agent {agent_id} attestation successful"
                         ));
                         return Ok("PASS".to_string());
                     }
                     _ => {
-                        // PENDING or missing — keep polling
+                        // PENDING or missing — update spinner and keep polling
+                        let elapsed = start.elapsed().as_secs();
+                        let state_str = operational_state
+                            .as_deref()
+                            .unwrap_or("pending");
+                        wait_handle.set_message(format!(
+                            "Waiting for attestation of agent {agent_id} \
+                             ({state_str}, {elapsed}s elapsed)"
+                        ));
                         debug!(
                             "Agent attestation status: {:?}, operational_state: {:?}, waiting...",
                             attestation_status, operational_state

keylimectl/src/commands/agent/add.rs

@@ -328,8 +328,11 @@ pub(super) async fn verify_key_derivation(
     let max_retries = 12;
     let base_interval = std::time::Duration::from_secs(1);
 
+    let wait_handle = output
+        .start_wait("Verifying key derivation (attempt 1/12)");
+
     for attempt in 0..max_retries {
-        output.progress(format!(
+        wait_handle.set_message(format!(
             "Verifying key derivation (attempt {}/{})",
             attempt + 1,
             max_retries
@@ -340,6 +343,7 @@ pub(super) async fn verify_key_derivation(
             .await
         {
             Ok(true) => {
+                drop(wait_handle);
                 output
                     .info("Key derivation verification successful");
                 return Ok(());
@@ -356,17 +360,17 @@ pub(super) async fn verify_key_derivation(
                         ),
                     ));
                 }
-                let wait = base_interval * 2u32.saturating_pow(
+                let delay = base_interval * 2u32.saturating_pow(
                     attempt.min(4) as u32,
                 );
                 debug!(
                     "Key derivation not yet complete (attempt {}/{}), \
                      retrying in {:?}",
                     attempt + 1,
                     max_retries,
-                    wait
+                    delay
                 );
-                tokio::time::sleep(wait).await;
+                tokio::time::sleep(delay).await;
             }
             Err(e) => {
                 // Network/protocol error — also retry
@@ -379,17 +383,17 @@ pub(super) async fn verify_key_derivation(
                         ),
                     ));
                 }
-                let wait = base_interval * 2u32.saturating_pow(
+                let delay = base_interval * 2u32.saturating_pow(
                     attempt.min(4) as u32,
                 );
                 debug!(
                     "Verification request failed (attempt {}/{}): {e}, \
                      retrying in {:?}",
                     attempt + 1,
                     max_retries,
-                    wait
+                    delay
                 );
-                tokio::time::sleep(wait).await;
+                tokio::time::sleep(delay).await;
             }
         }
     }

keylimectl/src/commands/agent/attestation.rs

@@ -354,7 +354,7 @@ mod tests {
 
     /// Create a test output handler
     fn _create_test_output() -> OutputHandler {
-        OutputHandler::new(crate::OutputFormat::Json, true) // Quiet mode for tests
+        OutputHandler::new(crate::OutputFormat::Json, true, crate::ColorMode::Never) // Quiet mode for tests
     }
 
     #[test]

keylimectl/src/commands/agent/mod.rs

@@ -528,7 +528,7 @@ mod tests {
 
     /// Create a test output handler
     fn create_test_output() -> OutputHandler {
-        OutputHandler::new(crate::OutputFormat::Json, true) // Quiet mode for tests
+        OutputHandler::new(crate::OutputFormat::Json, true, crate::ColorMode::Never) // Quiet mode for tests
     }
 
     /// Create a test measured boot policy file

keylimectl/src/commands/measured_boot.rs

@@ -383,7 +383,7 @@ mod tests {
 
     /// Create a test output handler
     fn create_test_output() -> OutputHandler {
-        OutputHandler::new(crate::OutputFormat::Json, true) // Quiet mode for tests
+        OutputHandler::new(crate::OutputFormat::Json, true, crate::ColorMode::Never) // Quiet mode for tests
     }
 
     /// Create a test runtime policy file

keylimectl/src/commands/policy/crud.rs

@@ -244,6 +244,7 @@ mod tests {
         let output = OutputHandler::new(
             crate::OutputFormat::Json,
             false,
+            crate::ColorMode::Never,
         );
         let result =
             format_evidence_result(&response, &output)
@@ -274,6 +275,7 @@ mod tests {
         let output = OutputHandler::new(
             crate::OutputFormat::Json,
             false,
+            crate::ColorMode::Never,
         );
         let result =
             format_evidence_result(&response, &output)

keylimectl/src/commands/verify/evidence.rs

@@ -658,6 +658,7 @@ mod tests {
             timeout: None,
             verbose: 0,
             quiet: false,
+            color: crate::ColorMode::Never,
             format: crate::OutputFormat::Json,
             command: Some(crate::Commands::Agent {
                 action: crate::AgentAction::List {