fix: address PR #32 review findings

- Add --batch --no-tty to all GPG invocations (fixes TestManifestTamperedSignatureFails hang)
- Add 'reserved 304' to mf.proto for removed atime field
- Restore IncludeDotfiles alias on include-dotfiles flag
- Replace http.Get with http.Client{Timeout: 30s} in manifest_loader.go

internal/cli/manifest_loader.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/urfave/cli/v2"
 )
@@ -18,7 +19,8 @@ func isHTTPURL(s string) bool {
 // The caller must close the returned reader.
 func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
 	if isHTTPURL(pathOrURL) {
-		resp, err := http.Get(pathOrURL) //nolint:gosec // user-provided URL is intentional
+		client := &http.Client{Timeout: 30 * time.Second}
+		resp, err := client.Get(pathOrURL) //nolint:gosec // user-provided URL is intentional
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch %s: %w", pathOrURL, err)
 		}

internal/cli/mfer.go

@@ -128,7 +128,8 @@ func (mfa *CLIApp) run(args []string) {
 						Usage:   "Resolve encountered symlinks",
 					},
 					&cli.BoolFlag{
-						Name: "include-dotfiles",
+						Name:    "include-dotfiles",
+						Aliases: []string{"IncludeDotfiles"},
 
 						Usage: "Include dot (hidden) files (excluded by default)",
 					},
@@ -220,7 +221,8 @@ func (mfa *CLIApp) run(args []string) {
 						Usage:   "Resolve encountered symlinks",
 					},
 					&cli.BoolFlag{
-						Name: "include-dotfiles",
+						Name:    "include-dotfiles",
+						Aliases: []string{"IncludeDotfiles"},
 
 						Usage: "Include dot (hidden) files (excluded by default)",
 					},