Type-check and lint the macOS build from Linux (closes #50)

script/lint-darwin (make lint-darwin; run by script/check, and its
commands by the Dockerfile lint stage) runs go vet and golangci-lint
with GOOS=darwin and cgo off. Compiling cgo for macOS needs Apple's SDK,
so the three functions that call go-keychain, which is cgo there, move
to keychainunlocker_cgo.go; a macOS build without cgo gets
keychainunlocker_nocgo.go and the macse stub, whose errors name the
missing macOS build with cgo. The rest of the keychain unlocker and its
plain-Go tests are now checked; their findings are fixed without
changing behaviour, and lines over 88 columns in the unchecked files
are wrapped.

Model: opus-5-5

README.md

@@ -498,6 +498,10 @@ secret decrypt encryption/mykey --input document.txt.age --output document.txt
 - **macOS**: Full support including Keychain and Secure Enclave integration
 - **Linux**: Full support (excluding macOS-specific features)
 
+The keychain and Secure Enclave unlockers need a macOS build with cgo. A macOS
+build without cgo, such as one cross-compiled from Linux, offers them but fails
+to add or use them.
+
 ## Security Considerations
 
 ### Threat Model
@@ -560,10 +564,16 @@ them. We provide:
 - `script/lint` — run `golangci-lint` in docker only: builds
   `Dockerfile.lint`, where the linter is a build step that runs on every
   call, also on an unchanged tree
+- `script/lint-darwin` — run `go vet` and `golangci-lint` in docker on
+  the code as a macOS build compiles it (`GOOS=darwin`), which a Linux
+  build never compiles; cgo is off, so the keychain unlocker's calls into
+  the keychain (`internal/secret/keychainunlocker_cgo.go`, and
+  `keychainunlocker_test.go`) and the Secure Enclave bindings
+  (`internal/macse`) are not checked
 - `script/fmt` — format all Go code (writes)
 - `script/fmt-check` — check formatting without writing
-- `script/check` — run `script/test`, `script/lint`, and
-  `script/fmt-check`
+- `script/check` — run `script/test`, `script/lint`,
+  `script/lint-darwin`, and `script/fmt-check`
 - `script/docker` — build the Docker image tagged with the project name
 - `script/cibuild` — CI entrypoint: `docker build --ulimit
   memlock=-1:-1 .` (memguard needs mlock; the Dockerfile runs the