1.0 quality polish — code review, tests, bug fixes, documentation (#32)

Comprehensive quality pass targeting 1.0 release:

- Code review and refactoring
- Fix open bugs (#14, #16, #23)
- Expand test coverage
- Lint clean
- README update with build instructions (#9)
- Documentation improvements

Branched from `next` (active dev branch).

Reviewed-on: #32
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

mfer/scanner.go

@@ -43,11 +43,12 @@ type ScanStatus struct {
 
 // ScannerOptions configures scanner behavior.
 type ScannerOptions struct {
-	IncludeDotfiles bool            // Include files and directories starting with a dot (default: exclude)
-	FollowSymLinks  bool            // Resolve symlinks instead of skipping them
-	Fs              afero.Fs        // Filesystem to use, defaults to OsFs if nil
-	SigningOptions  *SigningOptions // GPG signing options (nil = no signing)
-	Seed            string          // If set, derive a deterministic UUID from this seed
+	IncludeDotfiles   bool            // Include files and directories starting with a dot (default: exclude)
+	FollowSymLinks    bool            // Resolve symlinks instead of skipping them
+	IncludeTimestamps bool            // Include createdAt timestamp in manifest (default: omit for determinism)
+	Fs                afero.Fs        // Filesystem to use, defaults to OsFs if nil
+	SigningOptions    *SigningOptions // GPG signing options (nil = no signing)
+	Seed              string          // If set, derive a deterministic UUID from this seed
 }
 
 // FileEntry represents a file that has been enumerated.
@@ -274,6 +275,9 @@ func (s *Scanner) ToManifest(ctx context.Context, w io.Writer, progress chan<- S
 	s.mu.RUnlock()
 
 	builder := NewBuilder()
+	if s.options.IncludeTimestamps {
+		builder.SetIncludeTimestamps(true)
+	}
 	if s.options.SigningOptions != nil {
 		builder.SetSigningOptions(s.options.SigningOptions)
 	}