Thanks for a great project, It very helpful to me in many cases.
I have to report you one thing i found in core verify-checksums command behavior.

The wp core verify-checksums command warns about added files which should not be exists,
but it doesn't matches files was added to ABSPATH directory.

Reproduction

Just add some file named like sample.php to wordpress installation directory,
and run wp core verify-checksums command. It won't show you any warnings about sample.php file was added.
But if you move sample.php into wp-includes directory, then warnings will works fine.

I think it depends on filter_file method at : https://github.com/wp-cli/checksum-command/blob/master/src/Checksum_Core_Command.php#L130-L135

Take a look please.
Thanks for your time.