Enforce real timeouts on gpg subprocess calls (closes #62)

Every gpg run now has a one-minute deadline (gpgTimeout) on top of its
caller's context and is killed when either ends. A timeout is reported
as "gpg timed out" under the failing operation instead of "signal:
killed". Builder.Build and Checker.ExtractEmbeddedSigningKeyFP take a
context, so ToManifest's context now reaches signing and the
contextcheck suppression calling signing non-cancellable is gone.
Manifest loading takes no context, so its signature check is bounded by
the timeout alone. Killing gpg itself is enough: the gpg-agent it starts
runs detached and holds none of its output.

Model: opus-5-5

TODO.md

@@ -24,6 +24,10 @@ only thing left of the `chore/align-repo-policies` branch is the list below.
 
 # Completed Steps
 
+- 2026-10-03: every gpg run is killed after one minute or when its caller's
+  context ends, and a timeout reads as "gpg timed out" under the failing
+  operation; `Builder.Build` and `Checker.ExtractEmbeddedSigningKeyFP` take a
+  context, which reaches gpg (#62)
 - 2026-10-03: `fetch` removes whatever sits at a file's temp name and then
   creates the temp file only if that name is free, so a hard link left there
   cannot make it write into a file outside the destination directory (#115)
@@ -112,8 +116,7 @@ only thing left of the `chore/align-repo-policies` branch is the list below.
     - Add decompression size limit via io.LimitReader in deserializeInner()
     - Fix errors.Is dead code in checker; make AddFile verify totalRead == size
     - Export manifest type or define a public interface (pending)
-    - Replace GPG subprocess with pure-Go crypto (pending); add timeouts to
-      remaining subprocess calls
+    - Replace GPG subprocess with pure-Go crypto (pending)
 - CLI:
     - Kebab-case primary flag names; fix fetch URL construction with
       url.JoinPath; add http.Client timeout and retry with backoff to fetch;