Move the CLI to urfave/cli v3 (closes #110)

Ported per the library's v2-to-v3 migration guide: the app is a root
cli.Command, actions take a context and the command, and flag
environment variables become value sources. -v, -q and the version flag
are local so, as before, only the commands defining them accept them.
Every command stops reading flags at its first argument, as v2 did.
ErrWriter is stdout so usage errors print with their help. The action's
context reaches the manifest download in check, export and list.
testify rises to v1.12.1, which v3 requires; the urfave_cli_no_docs
build tag, which v3 lacks, is dropped. v3 accepts a flag given under two
names, so -v --verbose gives debug output, and the test pinning the
refusal becomes a TestVerboseCount case.

Model: opus-5-5

internal/cli/manifest_loader.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 // manifestFetchTimeout bounds HTTP requests made to fetch a manifest.
@@ -30,13 +30,13 @@ func isHTTPURL(s string) bool {
 
 // openManifestReader opens a manifest from a path or URL and returns a ReadCloser.
 // The caller must close the returned reader.
-func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
+func (mfa *CLIApp) openManifestReader(
+	ctx context.Context, pathOrURL string,
+) (io.ReadCloser, error) {
 	if isHTTPURL(pathOrURL) {
 		client := &http.Client{Timeout: manifestFetchTimeout}
 
-		req, err := http.NewRequestWithContext(
-			context.Background(), http.MethodGet, pathOrURL, nil,
-		)
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, pathOrURL, nil)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch %s: %w", pathOrURL, err)
 		}
@@ -67,9 +67,9 @@ func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
 // resolveManifestArg resolves the manifest path from CLI arguments.
 // HTTP(S) URLs are returned as-is. Directories are searched for index.mf.
 // If no argument is given, the current directory is searched.
-func (mfa *CLIApp) resolveManifestArg(ctx *cli.Context) (string, error) {
-	if ctx.Args().Len() > 0 {
-		arg := ctx.Args().Get(0)
+func (mfa *CLIApp) resolveManifestArg(cmd *cli.Command) (string, error) {
+	if cmd.Args().Len() > 0 {
+		arg := cmd.Args().Get(0)
 		if isHTTPURL(arg) {
 			return arg, nil
 		}