Make an unlocker's ID the name of its directory (closes #98)

Keychain and Secure Enclave unlocker IDs were the creation time to the
minute plus the host name, and passphrase unlocker IDs the time to the
minute, so two created within one minute shared an ID, and `unlocker
select`, `unlocker remove` and the selection after `unlocker add` acted on
the older one. Every unlocker's ID is now its directory name, unique in
its vault. `vault.ListUnlockers` returns each unlocker's metadata keyed by
that name, so `unlocker list` and shell completion no longer find IDs by
matching metadata. PGP unlocker IDs were `pgp-<fingerprint>`; a second
PGP unlocker for one key is refused by comparing fingerprints in metadata.

Model: opus-5-5

README.md

@@ -211,7 +211,9 @@ Generates and stores a random secret.
 
 #### `secret unlocker list [--json]` / `secret unlocker ls`
 
-Lists all unlockers in the current vault with their metadata.
+Lists all unlockers in the current vault with their metadata. An unlocker's ID,
+which `secret unlocker select` and `secret unlocker remove` take, is the name of
+its directory in `unlockers.d`.
 
 #### `secret unlocker add <type> [options]`