Enforce real timeouts on gpg subprocess calls (closes #62)

Every gpg run now has a one-minute deadline (gpgTimeout) on top of its
caller's context and is killed when either ends. A timeout is reported
as "gpg timed out" under the failing operation instead of "signal:
killed". Only gpg itself is killed; WaitDelay (one second) stops the run
from waiting on a process gpg left behind that still holds its output,
such as a wrapper script that does not exec the real gpg.
Builder.Build and Checker.ExtractEmbeddedSigningKeyFP take a context, so
ToManifest's context now reaches signing and the contextcheck
suppression calling signing non-cancellable is gone. Manifest loading
takes no context, so its signature check is bounded by the timeout
alone.

Model: opus-5-5

mfer/gpg_test.go

@@ -436,7 +436,7 @@ func TestGPGTimeoutWhenChildHoldsOutput(t *testing.T) {
 	t.Setenv("PATH", fakeGPGPath(t,
 		"#!/bin/sh\nsleep 3 &\necho $! >'"+pidFile+"'\nwait\n"))
 	t.Cleanup(func() {
-		pid, err := os.ReadFile(pidFile)
+		pid, err := os.ReadFile(pidFile) //nolint:gosec // G304: path inside t.TempDir()
 		require.NoError(t, err)
 
 		n, err := strconv.Atoi(strings.TrimSpace(string(pid)))