secret version list no longer shows a version without NOT_AFTER as expired (closes #150)

STATUS was `expired` for every version other than the current one, so after
a promote the newest version, which has no NOT_AFTER, read `expired`. STATUS
is now `current` for the current version, `expired` for another version
whose NOT_AFTER has passed, and `inactive` for any other version. README
describes the three.

Judgement call: the issue left the third word to the owner; `inactive` is
the word the plan comment on the issue chose.

Model: opus-5-5

README.md

@@ -185,6 +185,12 @@ Moves or renames a secret within the current vault.
 Lists all versions of a secret showing creation time, status, and validity
 period.
 
+STATUS is `current` for the secret's current version, `expired` for another
+version whose NOT_AFTER has passed, and `inactive` for any other version. Adding
+a version sets NOT_AFTER on the version that was current;
+`secret version promote` sets no times, so after promoting an older version the
+newest version shows `inactive`.
+
 #### `secret version promote <secret-name> <version>`
 
 Promotes a specific version to current by rewriting the secret's `current` file