[MakerFlyFly]

Summary

• Check both GPG import and listing return codes before assessing a public key; report failures with the existing error JSON, helper exit 2, and available diagnostics.
• Validate and read regular input files completely, then import the same bytes through stdin. Directories and read failures are errors, including zero-size directories on Windows.
• A failed import of input containing a public-key armor header is an error even when GPG emits NODATA and zero import statistics. Preserve the no-key exception for other inputs only after the existing status checks and a successful empty listing.
• Keep the normal ten-field JSON, business-verdict exit 0, key-assessment policy and temporary keyring cleanup.

Type of change

• Other: deterministic Python helper and sibling tests shipped with keys-sync.

Test plan

• The original two return-code regressions fail on fork base 4556f693 and pass with the repair.
• New directory and truncated-armor real-GPG regressions fail on reviewed head e1c2e10a and pass after the follow-up.
• Linux / Python 3.12.12 / GPG 2.2.40, unprivileged user: 61 keys-sync tests, 60 passed and the Windows-only test skipped.
• Windows / Python 3.12.13 / Git/MSYS GPG 2.4.8: 61 keys-sync tests, 52 passed and nine compatible-backend tests skipped; the production MSYS error regression runs and passes.
• Linux plugins: Ruff, formatting and mypy pass; pytest reports 424 passed, one skipped.
• Windows plugins: Ruff, formatting and mypy pass; pytest reports 230 passed, ten skipped with GPG absent from the default PATH.
• Real-GPG boundary probes: 17 Linux cases and 14 Windows control cases, covering armored/binary public keys, ordinary English/Unicode text, empty and mismatched inputs, directories, truncated armor, CRC errors, partial imports and execution failures; temporary keyrings are removed.
• A real-GPG regression changes the file after Python reads it and confirms the original public-key bytes are assessed.
• Final full prek run --all-files including lychee passes in the Linux checkout; the two source files match the Windows workspace byte for byte.
• Magpie pre-first-pr-check for 06056d2c: all five categories pass; ready with zero blocking items.
• Remote CI for 06056d2c: no workflow run or check suite has been reported, including after a single close/reopen refresh that kept the PR Draft. Remote CI remains unverified; old-head success is not reused.

RFC-AI-0004 compliance

• The helper continues to handle public information in a disposable keyring.
• Release signing stays with the RM; the change adds no signing or outbound-message operation.

Linked issues

Fixes fork issue #11.

Notes for reviewers

The branch starts at fork main (4556f693) and contains no commits from Draft PR #9.
The follow-up addresses a real omission found in reviewed head e1c2e10a: NODATA plus zero counts does not establish that an input was read correctly or contains no malformed public-key block.
The fix adds input evidence and imports one complete byte snapshot; it does not match English stderr or add a new status blacklist.

No key strength, signing-subkey admission, signer selection or signature verification policy changed.
This remains independent of upstream issue #1628, including Option 2.
Windows/MSYS homedir path compatibility remains unresolved; its production acceptance is an accurate error with exit 2.
Windows test-only homedir translation is a control experiment, and native Windows GPG was unavailable for separate verification.

No skill prompt or eval fixture changed.
The original nine-case print-mode author self-evaluation was a compatibility smoke check only: the existing Step 1 fixtures have no helper-error case, and model-layer error forwarding has not been independently evaluated.
The Windows eval renderer's baseline legacy-symlink issue is unchanged; earlier prompt rendering was performed in Linux.

Gen-AI disclosure: OpenAI Codex (GPT-6) assisted with the code, tests and text.
This Draft PR is submitted to the contributor's fork for human audit and does not claim completed human review.