Delete .tmp- leftovers of a killed command when the lock is next taken (closes #75)

A command killed part-way could leave a temporary file or directory of
secret.WriteFileAtomic or secret.TempDirFor, encrypted keys included,
for good. LockStateDir now empties the lock file once it holds the lock
and writes "finished" there just before releasing it. A holder that
does not find that deletes such leftovers from the state directory,
each vault, each secret and each version, the only places those helpers
make them, matching names that start with "." and hold ".tmp-". After a
command that finished nothing is searched, so the added time does not
grow with the number of secrets and versions. A test shows that
`unlocker remove` removes an unlocker directory with no metadata file.

Model: opus-5-5

TODO.md

@@ -18,6 +18,21 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-04: What a command killed part-way left under a `.tmp-` name
+  (https://git.eeqj.de/sneak/secret/issues/75), the temporary directories
+  of `secret.TempDirFor` and the temporary files of
+  `secret.WriteFileAtomic`, encrypted keys included, is deleted by the next
+  command that takes the state directory lock. Before, it stayed until
+  deleted by hand. A command writes `finished` into the lock file just
+  before it releases the lock; the next one to take the lock searches only
+  when it does not find that, so after a command that finished nothing is
+  searched, however many secrets and versions there are. The search looks
+  in the state directory, each vault, each secret and each version, the
+  only directories those helpers make them in. A command that only reads
+  takes no lock and deletes nothing. A failure to delete is warned about
+  and the command goes on. An unlocker directory with no metadata file was
+  already removed by `secret unlocker remove` given its directory name; a
+  test now shows it.
 - 2026-10-04: An age identity's private key goes into a locked buffer
   through `secret.IdentityToLockedBuffer` everywhere
   (https://git.eeqj.de/sneak/secret/issues/38): the vault's long-term key
@@ -228,15 +243,10 @@ https://git.eeqj.de/sneak/secret/milestone/12
   cross-vault copies are built in a temporary directory and renamed
   into place, and removals rename out of the way first, so a version
   or secret is never half-added and never half-removed. An
-  interrupted command can still leave:
-    - from `init` or `vault create` killed after the passphrase prompt
-      but before the unlocker is written, a vault with no unlocker,
-      which `vault create` has already made the current vault;
-    - data under a `.tmp-` name in the state directory: a secret,
-      version or unlocker being added, or the secret, version, unlocker
-      or vault being removed, encrypted keys included. Nothing deletes
-      it; it must be deleted by hand
-      (https://git.eeqj.de/sneak/secret/issues/75).
+  interrupted command can still leave, from `init` or `vault create`
+  killed after the passphrase prompt but before the unlocker is
+  written, a vault with no unlocker, which `vault create` has already
+  made the current vault.
 - 2026-10-03: The checks run before changing a vault now stop with an
   error naming the path and cause when they cannot read what they
   inspect, instead of reading the failure as "nothing there": the