Ask for the mnemonic and passphrase before taking the state directory lock (closes #152)

init, vault create, unlocker add, and add, import and generate secret
with --force asked for the mnemonic or passphrase, or unlocked the
vault, while holding the state directory lock, so every other command
that changes anything waited at the prompt. They now ask and unlock
first and lock after. What they checked before asking is checked again
under the lock: unlocker add fails if the vault was removed meanwhile
and refuses a GPG key added meanwhile. A forced add of a secret that
another command created meanwhile lets go of the lock, gets the key,
and takes the lock again. secret.CreatePGPUnlocker now takes the vault,
already unlocked; SetMnemonic and SetUnlockPassphrase, used only by it,
are gone.

Not done: secret move between vaults still unlocks both under the lock;
the issue does not name it.

Model: opus-5-5

README.md

@@ -438,6 +438,13 @@ asks when stdin is a pipe, as in `echo value | secret add name --force` or
 `cat file | secret encrypt key`. With no controlling terminal, as under cron or
 in a CI job, the command fails and names the variable to set.
 
+A command that changes anything locks the state directory, through its file
+`lock`, and another such command waits until the lock is released.
+`secret init`, `secret vault create`, `secret unlocker add`, and `secret add`,
+`secret import` and `secret generate secret` with `--force`, ask for the
+mnemonic or passphrase before they take the lock, so a prompt left open in one
+terminal holds up no command in another.
+
 ## Security Features
 
 ### Encryption