Update golangci-lint to v2.12.2 with canonical config (closes #60)

Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree.

Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker.

All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.

internal/cli/manifest_loader.go

@@ -1,6 +1,8 @@
 package cli
 
 import (
+	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -10,6 +12,17 @@ import (
 	"github.com/urfave/cli/v2"
 )
 
+// manifestFetchTimeout bounds HTTP requests made to fetch a manifest.
+const manifestFetchTimeout = 30 * time.Second
+
+// errHTTPStatus indicates an HTTP response with a non-OK status code.
+//
+// Its text is the literal "HTTP" prefix of the rendered "HTTP <code>"
+// message that mfer has always printed, so that wrapping it does not
+// change any user-visible output. Match it with errors.Is; do not read
+// its message.
+var errHTTPStatus = errors.New("HTTP")
+
 // isHTTPURL returns true if the string starts with http:// or https://.
 func isHTTPURL(s string) bool {
 	return strings.HasPrefix(s, "http://") || strings.HasPrefix(s, "https://")
@@ -19,21 +32,35 @@ func isHTTPURL(s string) bool {
 // The caller must close the returned reader.
 func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
 	if isHTTPURL(pathOrURL) {
-		client := &http.Client{Timeout: 30 * time.Second}
-		resp, err := client.Get(pathOrURL) //nolint:gosec // user-provided URL is intentional
+		client := &http.Client{Timeout: manifestFetchTimeout}
+
+		req, err := http.NewRequestWithContext(
+			context.Background(), http.MethodGet, pathOrURL, nil,
+		)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch %s: %w", pathOrURL, err)
 		}
+
+		resp, err := client.Do(req)
+		if err != nil {
+			return nil, fmt.Errorf("failed to fetch %s: %w", pathOrURL, err)
+		}
+
 		if resp.StatusCode != http.StatusOK {
 			_ = resp.Body.Close()
-			return nil, fmt.Errorf("failed to fetch %s: HTTP %d", pathOrURL, resp.StatusCode)
+
+			return nil, fmt.Errorf("failed to fetch %s: %w %d",
+				pathOrURL, errHTTPStatus, resp.StatusCode)
 		}
+
 		return resp.Body, nil
 	}
+
 	f, err := mfa.Fs.Open(pathOrURL)
 	if err != nil {
 		return nil, err
 	}
+
 	return f, nil
 }
 
@@ -46,11 +73,14 @@ func (mfa *CLIApp) resolveManifestArg(ctx *cli.Context) (string, error) {
 		if isHTTPURL(arg) {
 			return arg, nil
 		}
+
 		info, statErr := mfa.Fs.Stat(arg)
 		if statErr == nil && info.IsDir() {
 			return findManifest(mfa.Fs, arg)
 		}
+
 		return arg, nil
 	}
+
 	return findManifest(mfa.Fs, ".")
 }