Enforce real timeouts on gpg subprocess calls (closes #62)

Every gpg run now has a one-minute deadline (gpgTimeout) on top of its
caller's context and is killed when either ends. A timeout is reported
as "gpg timed out" under the failing operation instead of "signal:
killed". Only gpg itself is killed; WaitDelay (one second) stops the run
from waiting on a process gpg left behind that still holds its output,
such as a wrapper script that does not exec the real gpg.
Builder.Build and Checker.ExtractEmbeddedSigningKeyFP take a context, so
ToManifest's context now reaches signing and the contextcheck
suppression calling signing non-cancellable is gone. Manifest loading
takes no context, so its signature check is bounded by the timeout
alone.

Model: opus-5-5

mfer/gpg_test.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -428,9 +429,23 @@ func TestGPGTimeoutKillsGPG(t *testing.T) {
 // child instead of exec-ing it, the way a wrapper script around the real
 // gpg might. Killing the fake gpg leaves sleep holding its stdout and
 // stderr open; the call must still return shortly after the deadline
-// instead of waiting for sleep to exit.
+// instead of waiting for sleep to exit. The fake gpg writes the process ID
+// of sleep to a file so that the test can kill it before returning.
 func TestGPGTimeoutWhenChildHoldsOutput(t *testing.T) {
-	t.Setenv("PATH", fakeGPGPath(t, "#!/bin/sh\nsleep 3\nexit\n"))
+	pidFile := filepath.Join(t.TempDir(), "sleep.pid")
+	t.Setenv("PATH", fakeGPGPath(t,
+		"#!/bin/sh\nsleep 3 &\necho $! >'"+pidFile+"'\nwait\n"))
+	t.Cleanup(func() {
+		pid, err := os.ReadFile(pidFile)
+		require.NoError(t, err)
+
+		n, err := strconv.Atoi(strings.TrimSpace(string(pid)))
+		require.NoError(t, err)
+
+		sleep, err := os.FindProcess(n)
+		require.NoError(t, err)
+		require.NoError(t, sleep.Kill())
+	})
 
 	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
 	defer cancel()