Move the CLI to urfave/cli v3 (closes #110)

Ported per the library's v2-to-v3 migration guide: the app is a root
cli.Command, actions take a context and the command, and flag
environment variables become value sources. -v, -q and the version flag
are local so, as before, only the commands defining them accept them.
Every command stops reading flags at its first argument, as v2 did.
ErrWriter is stdout so usage errors print with their help. The action's
context reaches the manifest download in check, export and list.
testify rises to v1.12.1, which v3 requires; the urfave_cli_no_docs
build tag, which v3 lacks, is dropped. v3 accepts a flag given under two
names, so -v --verbose gives debug output, and the test pinning the
refusal becomes a TestVerboseCount case.

Model: opus-5-5

internal/cli/mfer.go

@@ -422,10 +422,8 @@ func (mfa *CLIApp) run(args []string) {
 		Version:               mfa.VersionString(),
 		EnableShellCompletion: true,
 		Writer:                mfa.Stdout,
-		// urfave/cli writes only its "Incorrect Usage" line to ErrWriter. It
-		// goes to stdout with the help printed after it; run logs the error
-		// itself to stderr. Tests rely on the logger being the only writer to
-		// a run's stderr.
+		// v3 writes its "Incorrect Usage" line to ErrWriter; v2 wrote it to
+		// stdout, before the help, so it stays on stdout.
 		ErrWriter:    mfa.Stdout,
 		Flags:        commonFlags(),
 		StopOnNthArg: stopOnFirstArg(),