docs(website): promote CLI v0.3.2 with bilingual --verbose progress guide

en/cli.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="description" content="Download current Catalog-registered PostgreSQL extension ZIPs for Windows x64. Signed Catalog selection, strict original ZIP SHA256, and an explicit frozen-snapshot mode. This read-only CLI does not install extensions.">
-  <title>pgextwin — Windows CLI v0.3.1</title>
+  <title>pgextwin — Windows CLI v0.3.2</title>
   <link rel="canonical" href="https://pgextwin.github.io/website/en/cli.html">
   <link rel="alternate" hreflang="en" href="https://pgextwin.github.io/website/en/cli.html">
   <link rel="alternate" hreflang="ja" href="https://pgextwin.github.io/website/ja/cli.html">
@@ -14,23 +14,23 @@
   <a class="skip-link" href="#download-heading">Get the Windows executable</a>
   <header class="site-header"><div class="shell">
     <nav class="language-nav" aria-label="Language / 言語"><a href="../ja/cli.html" lang="ja">日本語</a><a href="./">Extension catalog</a></nav>
-    <p class="eyebrow">pgextwin CLI</p><h1>Windows CLI v0.3.1</h1>
-    <p class="lead">A safer one-line download, now 83.83% smaller.</p><p class="cli-hero-description">Download current Catalog-registered PostgreSQL extension ZIPs for Windows x64. Signed Catalog selection, strict original ZIP SHA256, and an explicit frozen-snapshot mode. This read-only CLI does not install extensions.</p>
+    <p class="eyebrow">pgextwin CLI</p><h1>Windows CLI v0.3.2</h1>
+    <p class="lead">Download with real-time, opt-in verbose progress.</p><p class="cli-hero-description">Download current Catalog-registered PostgreSQL extension ZIPs for Windows x64. Signed Catalog selection, strict original ZIP SHA256, and an explicit frozen-snapshot mode. This read-only CLI does not install extensions.</p>
     <nav class="jump-nav" aria-label="CLI navigation"><a class="jump-nav-primary" href="#download-heading">Get the Windows executable</a><a href="#flow-heading">How it works</a><a href="#release-notes-heading">Release notes</a></nav>
   </div></header>
   <main class="shell cli-page">
     <section class="cli-download" aria-labelledby="download-heading">
       <p class="eyebrow">Windows x64 · self-contained · prerelease</p>
       <h2 id="download-heading">Get the Windows executable</h2>
       <div class="cli-download-actions">
-        <a class="download-link" href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.1/pgextwin.exe">Download pgextwin.exe (12.83 MB)</a>
-        <a href="https://github.com/pgextwin/catalog/releases/tag/cli-v0.3.1">GitHub Release v0.3.1</a>
-        <a href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.1/SHA256SUMS.txt">SHA256SUMS.txt</a>
+        <a class="download-link" href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.2/pgextwin.exe">Download pgextwin.exe (12.83 MB)</a>
+        <a href="https://github.com/pgextwin/catalog/releases/tag/cli-v0.3.2">GitHub Release v0.3.1</a>
+        <a href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.2/SHA256SUMS.txt">SHA256SUMS.txt</a>
       </div>
-      <p class="cli-sha"><strong>Published EXE SHA256:</strong> <code>baee38b3aafdd1bbb7f61857747358dbd40ab056d989aa0f753c93b2025a7580</code></p>
+      <p class="cli-sha"><strong>Published EXE SHA256:</strong> <code>d4e8f63d402066b21db9d537f7679b51137ec47d9834fa4fd75b5889ad34e6f4</code></p>
       <p>Compare against the published SHA256SUMS.txt and validate the CLI build provenance:</p>
       <pre><code>Get-FileHash .\pgextwin.exe -Algorithm SHA256
-gh attestation verify .\pgextwin.exe --repo pgextwin/catalog --signer-workflow pgextwin/catalog/.github/workflows/cli-candidate.yml --source-ref refs/heads/main --source-digest a7a1d93d38d7338d80404c402eb5faaaa96b272e</code></pre>
+gh attestation verify .\pgextwin.exe --repo pgextwin/catalog --signer-workflow pgextwin/catalog/.github/workflows/cli-candidate.yml --source-ref refs/heads/main --source-digest a537f14f39be4b4ffc366cd0fef83f87aa4b9c39</code></pre>
     </section>
     <section aria-labelledby="commands-heading">
       <h2 id="commands-heading">One-line usage</h2><p>Default: newest release approved and registered in the Catalog; no GitHub REST API credentials required. ZIPs are written in a new folder under the working directory.</p>
@@ -40,6 +40,16 @@ <h2 id="commands-heading">One-line usage</h2><p>Default: newest release approved
         <div><strong>Fixed historical snapshot · 70 ZIPs</strong><pre><code>.\pgextwin.exe download-all --pg all --fixed</code></pre></div>
       </div>
     </section>
+    <section aria-labelledby="verbose-heading">
+      <p class="eyebrow">New in v0.3.2</p>
+      <h2 id="verbose-heading">Live progress with --verbose</h2>
+      <p>Opt-in UTC timestamped events report signed Catalog verification, every ZIP start, transferred bytes in 8 MiB intervals, SHA256 verification and batch completion. Diagnostic events go to stderr; normal stdout and JSON remain unchanged.</p>
+      <div class="cli-command-list">
+        <div><strong>Download all 70 ZIPs with live progress</strong><pre><code>.\pgextwin.exe download-all --pg all --verbose</code></pre></div>
+        <div><strong>Keep a detailed log file</strong><pre><code>.\pgextwin.exe download-all --pg all --verbose 2&gt; download-verbose.log</code></pre></div>
+      </div>
+      <p class="cli-caution" role="note">Verbose output does not change trust: individual extension ZIPs remain INTEGRITY_ONLY. No install or extension publication privileges are added.</p>
+    </section>
     <section aria-labelledby="flow-heading">
       <p class="eyebrow">How it works / 動作のしくみ</p>
       <h2 id="flow-heading">How it works</h2><p>The two download paths converge on the same original-ZIP integrity checks and atomic output. The displayed steps describe the CLI, not a Windows installer.</p>
@@ -82,14 +92,14 @@ <h2 id="other-heading">Other commands</h2><p>Local Catalog browsing is separate
       <p><code>UNVERIFIED</code> · <code>INTEGRITY_ONLY</code></p>
     </section>
     <section aria-labelledby="release-notes-heading">
-      <p class="eyebrow">v0.3.1</p><h2 id="release-notes-heading">Release notes</h2>
+      <p class="eyebrow">v0.3.2</p><h2 id="release-notes-heading">Release notes</h2>
       <div class="cli-release-notes"><article lang="en" class="cli-note-block" aria-labelledby="notes-en-title">
-  <h3 id="notes-en-title">English</h3>
-  <p><strong>CLI v0.3.1 — smaller executable, same safety checks.</strong> The self-contained Windows x64 executable was reduced from 79,338,604 to 12,827,362 bytes (83.83%) using full trimming and single-file compression. JSON responses are generated with trim-compatible System.Text.Json metadata rather than suppressed IL2026 warnings.</p>
-  <p>By default, <code>download-all --pg all</code> authenticates the publicly signed Catalog selection feed and downloads the current Catalog-registered set of 14 extensions × PG14–18 (70 original ZIP files). Use <code>--pg 18</code> to select one major or <code>--fixed</code> to use the historical immutable snapshot. Each downloaded ZIP is rehashed, and a failed batch is removed without overwriting existing downloads.</p>
-  <p><strong>Security boundary:</strong> Sigstore verification authenticates the Catalog feed and independently attested CLI executable. Extension ZIP bytes are checked against Catalog-pinned SHA256 values (<code>INTEGRITY_ONLY</code>); their own Sigstore signatures, provenance and installation/publication authorizations are <strong>not verified or granted</strong>. CLI v0.3.1 is a published prerelease, not a Windows Authenticode-signed installer.</p>
-  <p><a href="https://github.com/pgextwin/catalog/actions/runs/39254657650">Independent public EXE and 70/70 ZIP Windows verification</a> · <a href="https://github.com/pgextwin/catalog/releases/tag/cli-v0.3.1">Full GitHub Release</a></p>
-</article></div>
+        <h3 id="notes-en-title">English</h3>
+        <p><strong>CLI v0.3.2 — live diagnostic progress.</strong> Use <code>--verbose</code> to follow Catalog Sigstore verification, individual download starts, 8 MiB transfer updates, SHA256 checks and the final 70-ZIP completion. Logs are on stderr; stdout and JSON contracts are unchanged.</p>
+        <p>The trim-compressed Windows x64 EXE is 12,829,662 bytes. Latest signed-Catalog and historical <code>--fixed</code> modes remain supported. Download failures still reject unsafe bytes, avoid overwriting existing output and fail closed.</p>
+        <p><strong>Scope:</strong> The CLI executable and Catalog feed have their own verification; original extension ZIPs are <code>INTEGRITY_ONLY</code>, not individually Sigstore-authenticated. No installation or extension-release authorization is granted.</p>
+        <p><a href="https://github.com/pgextwin/catalog/actions/runs/39342699236">Public v0.3.2 EXE Sigstore and verbose 70/70 ZIP Windows audit</a> · <a href="https://github.com/pgextwin/catalog/releases/tag/cli-v0.3.2">Full GitHub Release (English → Japanese)</a></p>
+      </article></div>
     </section>
   </main>
 </body>

en/index.html

@@ -21,7 +21,7 @@ <h1>PostgreSQL Extensions for Windows</h1>
       <p class="lead">Find Windows x64 extension binaries by PostgreSQL version, download the canonical Release asset directly, and inspect runtime requirements, CI-tested capabilities, checksums, and supply-chain evidence.</p>
       <nav class="jump-nav" aria-label="Page sections">
         <a class="jump-nav-primary" href="#extensions-heading">Browse downloads</a>
-        <a href="./cli.html">CLI v0.3.1</a>
+        <a href="./cli.html">CLI v0.3.2</a>
         <a href="#landscape-heading">Other Windows sources</a>
         <a href="#about-heading">About pgextwin</a>
       </nav>
@@ -37,7 +37,7 @@ <h2 id="cli-home-heading">Download Catalog-registered ZIPs with one command</h2>
       <p>14 extensions × PostgreSQL 14–18 = <strong>70 original ZIPs</strong>. The CLI authenticates the Sigstore-signed Catalog feed, checks each ZIP SHA256, and preserves an explicit historical <code>--fixed</code> mode. Original ZIP signatures remain <code>INTEGRITY_ONLY</code>.</p>
       <pre><code>.\pgextwin.exe download-all --pg all</code></pre>
       <div class="cli-teaser-metrics"><strong>−83.83%</strong><span>79.34 MB → 12.83 MB (v0.3.0 → v0.3.1)</span></div>
-      <div class="cli-teaser-actions"><a class="download-link" href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.1/pgextwin.exe">Download CLI v0.3.1</a><a href="./cli.html">Visual guide, safety and release notes →</a></div>
+      <div class="cli-teaser-actions"><a class="download-link" href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.2/pgextwin.exe">Download CLI v0.3.2</a><a href="./cli.html">Visual guide, safety and release notes →</a></div>
     </section>
 
     <section aria-labelledby="extensions-heading">