Make an unlocker's ID the name of its directory (closes #98)

Keychain and Secure Enclave unlocker IDs were the creation time to the
minute plus the host name, and passphrase unlocker IDs the time to the
minute, so two created within one minute shared an ID, and `unlocker
select`, `unlocker remove` and the selection after `unlocker add` acted on
the older one. Every unlocker's ID is now its directory name, unique in
its vault. `vault.ListUnlockers` returns each unlocker's metadata keyed by
that name, so `unlocker list` and shell completion no longer find IDs by
matching metadata. PGP unlocker IDs were `pgp-<fingerprint>`; a second
PGP unlocker for one key is refused by comparing fingerprints in metadata.

Model: opus-5-5

internal/cli/confirm_test.go

@@ -101,7 +101,8 @@ func newRemoval(t *testing.T, command string) removal {
 	}
 
 	fs, workDir, older := newConfirmTestVaults(t, unlockers)
-	unlockerID := "pgp-" + listTestGPGKeyID + "A"
+	// The first unlocker's directory name, written by newConfirmTestVaults
+	unlockerID := "pgp-0"
 
 	removeFirstUnlocker := func(cli *Instance, cmd *cobra.Command, force bool) error {
 		return cli.UnlockersRemove(unlockerID, force, cmd)
@@ -142,7 +143,7 @@ func newRemoval(t *testing.T, command string) removal {
 		return removal{
 			fs:      fs,
 			run:     removeFirstUnlocker,
-			removed: filepath.Join(workDir, "unlockers.d", "pgp-0"),
+			removed: filepath.Join(workDir, "unlockers.d", unlockerID),
 			question: "Permanently remove unlocker '" + unlockerID +
 				"' from vault 'work'? It is not the vault's last unlocker.",
 		}
@@ -150,7 +151,7 @@ func newRemoval(t *testing.T, command string) removal {
 		return removal{
 			fs:      fs,
 			run:     removeFirstUnlocker,
-			removed: filepath.Join(workDir, "unlockers.d", "pgp-0"),
+			removed: filepath.Join(workDir, "unlockers.d", unlockerID),
 			question: "Permanently remove unlocker '" + unlockerID +
 				"', the last unlocker of vault 'work', which holds 1 " +
 				"secret(s)? Without an unlocker the vault opens only " +