Remove the keychain and Secure Enclave unlockers (closes #132)

Neither unlocker works without macOS code signing and entitlements, which
secret does not have, so both were research and leave the build.
`secret unlocker add` takes only passphrase and pgp on every platform;
keychain and secure-enclave fail as unknown types and are gone from
--help and shell completion. internal/macse, their files in
internal/secret with their tests, and their branches in internal/vault
and internal/cli are deleted; github.com/keybase/go-keychain leaves
go.mod and go.sum. README and Dockerfile comments no longer mention
them. The research stays at ef0ae90, tagged v1.0.0-rc1.

Judgement call: derivation_index_test.go goes with getLongTermPrivateKey,
its only subject, which only these two unlockers used.
Unverified: not built or run on a Mac; only the GOOS=darwin vet and lint ran.

Model: opus-5-5

internal/vault/vault.go

@@ -109,9 +109,8 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 		slog.String("unlocker_id", unlocker.GetID()),
 	)
 
-	// Get the long-term key via the unlocker.
-	// SE unlockers return the long-term key directly from GetIdentity().
-	// Other unlockers return their own identity, used to decrypt longterm.age.
+	// Get the long-term key via the unlocker: its identity decrypts
+	// longterm.age.
 	ltIdentity, err := v.unlockLongTermKey(unlocker)
 	if err != nil {
 		return nil, v.withMnemonicAdvice(err)
@@ -254,23 +253,10 @@ func (v *Vault) deriveLongTermKeyFromMnemonic(
 }
 
 // unlockLongTermKey extracts the vault's long-term key using the given
-// unlocker. SE unlockers decrypt the long-term key directly; other unlockers
-// use an intermediate identity.
+// unlocker's identity.
 func (v *Vault) unlockLongTermKey(
 	unlocker secret.Unlocker,
 ) (*age.X25519Identity, error) {
-	if unlocker.GetType() == unlockerTypeSecureEnclave {
-		secret.Debug("SE unlocker: decrypting long-term key directly via Secure Enclave")
-
-		ltIdentity, err := unlocker.GetIdentity()
-		if err != nil {
-			return nil, fmt.Errorf("failed to decrypt long-term key via SE: %w", err)
-		}
-
-		return ltIdentity, nil
-	}
-
-	// Standard unlockers: get unlocker identity, then decrypt longterm.age
 	unlockerIdentity, err := unlocker.GetIdentity()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get unlocker identity: %w", err)