Move the CLI to urfave/cli v3 (closes #110)

Ported per the library's v2-to-v3 migration guide: the app is a root
cli.Command, actions take a context and the command, and flag environment
variables become value sources. -v, -q and the version flag are marked
local so that, as before, only the commands that define them accept them.
go mod tidy raises testify to v1.12.1, which v3 requires. The
urfave_cli_no_docs build tag is dropped from script/build and the
Dockerfile; v3 has no such tag. v3 no longer refuses a flag given under
two of its names, so -v --verbose now gives debug output, and the test
that pinned the refusal becomes a TestVerboseCount case. Help text follows
v3's templates.

Model: opus-5-5

internal/cli/fetch_test.go

@@ -4,7 +4,6 @@ package cli
 import (
 	"bytes"
 	"context"
-	"flag"
 	"fmt"
 	"io"
 	"maps"
@@ -23,7 +22,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	urfcli "github.com/urfave/cli/v2"
 	"sneak.berlin/go/mfer/mfer"
 )
 
@@ -1322,18 +1320,13 @@ func TestFetchTimeoutFlag(t *testing.T) {
 
 	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
 
-	set := flag.NewFlagSet(cmdFetch, flag.ContinueOnError)
-	for _, f := range mfa.fetchCommand().Flags {
-		require.NoError(t, f.Apply(set))
-	}
-
-	require.NoError(t, set.Parse([]string{"--" + flagTimeout, "100ms", server.URL}))
-
-	cliCtx := urfcli.NewContext(nil, set, nil)
-	cliCtx.Context = ctx
+	cmd := mfa.fetchCommand()
+	cmd.Action = mfa.fetchManifestOperation
 
 	// fetchManifestOperation logs to the process-global logger.
-	err := runLocked(func() error { return mfa.fetchManifestOperation(cliCtx) })
+	err := runLocked(func() error {
+		return cmd.Run(ctx, []string{cmdFetch, "--" + flagTimeout, "100ms", server.URL})
+	})
 	require.Error(t, err)
 }