Remove the keychain and Secure Enclave unlockers (closes #132)

Neither unlocker works without macOS code signing and entitlements, which
secret does not have, so both were research and leave the build.
`secret unlocker add` takes only passphrase and pgp on every platform;
keychain and secure-enclave fail as unknown types and are gone from
--help and shell completion. internal/macse, their files in
internal/secret with their tests, and their branches in internal/vault
and internal/cli are deleted; github.com/keybase/go-keychain leaves
go.mod and go.sum. README and Dockerfile comments no longer mention
them. The research stays at ef0ae90, tagged v1.0.0-rc1.

Judgement call: derivation_index_test.go goes with getLongTermPrivateKey,
its only subject, which only these two unlockers used.
Unverified: not built or run on a Mac; only the GOOS=darwin vet and lint ran.

Model: opus-5-5

README.md

@@ -223,8 +223,6 @@ Creates a new unlocker of the specified type:
 
 - `passphrase`: Traditional passphrase-protected unlocker
 - `pgp`: Uses an existing GPG key for encryption/decryption
-- `keychain`: macOS Keychain integration (macOS only)
-- `secure-enclave`: Hardware-backed Secure Enclave protection (macOS only)
 
 **Options:**
 
@@ -345,21 +343,6 @@ Unlockers provide different authentication methods to access the long-term keys:
     - Leverages existing key management workflows
     - Strong authentication through GPG
 
-3. **Keychain Unlockers** (macOS only):
-    - Stores unlock keys in macOS Keychain
-    - Kept on this Mac only: the keychain item is never synced to other devices
-    - Automatic unlocking when Keychain is unlocked
-    - Cross-application integration
-
-4. **Secure Enclave Unlockers** (macOS):
-    - Hardware-backed key storage using Apple Secure Enclave
-    - Uses `sc_auth` / CryptoTokenKit for SE key management (no Apple Developer
-      Program required)
-    - ECIES encryption: the vault long-term key is encrypted directly to the SE
-      key, and only the SE can decrypt it
-    - The SE key cannot leave this Mac; using it asks for no Touch ID or
-      password
-
 Each vault maintains its own set of unlockers and one long-term key. The
 long-term key is encrypted to each unlocker, allowing any authorized unlocker to
 access vault secrets.
@@ -412,9 +395,6 @@ variables.
 ### Hardware Integration
 
 - Hardware token support via PGP/GPG integration
-- macOS Keychain integration for system-level security
-- Secure Enclave integration for hardware-backed key protection (macOS, via
-  `sc_auth` / CryptoTokenKit)
 
 ## Examples
 
@@ -468,8 +448,6 @@ secret vault remove personal --force
 # Add multiple unlock methods
 secret unlocker add passphrase              # Password-based
 secret unlocker add pgp --keyid ABCD1234    # GPG key
-secret unlocker add keychain                # macOS Keychain (macOS only)
-secret unlocker add secure-enclave          # macOS Secure Enclave (macOS only)
 
 # List unlockers
 secret unlocker list
@@ -538,12 +516,8 @@ secret decrypt encryption/mykey --input document.txt.age --output document.txt
 
 ### Cross-Platform Support
 
-- **macOS**: Full support including Keychain and Secure Enclave integration
-- **Linux**: Full support (excluding macOS-specific features)
-
-The keychain and Secure Enclave unlockers need a macOS build with cgo. A macOS
-build without cgo, such as one cross-compiled from Linux, offers them but fails
-to add or use them.
+- **macOS**: Full support
+- **Linux**: Full support
 
 ## Security Considerations
 
@@ -556,7 +530,7 @@ to add or use them.
 ### Best Practices
 
 1. Use strong, unique passphrases for unlockers
-2. Enable hardware authentication (Keychain, hardware tokens) when available
+2. Enable hardware authentication (hardware tokens) when available
 3. Regularly audit unlockers and remove unused ones
 4. Keep mnemonic phrases securely backed up offline
 5. Use separate vaults for different security contexts
@@ -565,7 +539,6 @@ to add or use them.
 
 - Requires access to unlockers for secret retrieval
 - Mnemonic phrases must be securely stored and backed up
-- Hardware features limited to supported platforms
 
 ## Development
 
@@ -610,10 +583,7 @@ provide:
   rerun passes
 - `script/lint` — build the `lint` phase of the `Dockerfile`, which runs
   `go vet` and `golangci-lint`, then both again on the code as a macOS build
-  compiles it (`GOOS=darwin`), which a Linux build never compiles; cgo is off
-  there, so the keychain unlocker's calls into the keychain
-  (`internal/secret/keychainunlocker_cgo.go`, and `keychainunlocker_test.go`)
-  and the Secure Enclave bindings (`internal/macse`) are not checked
+  compiles it (`GOOS=darwin`, with cgo off), which a Linux build never compiles
 - `script/fmt` — format all Go code with `go fmt` and every markdown file with
   prettier (4-space tabs, `proseWrap: always`) (writes)
 - `script/fmt-check` — check the same formatting without writing, on the host
@@ -629,8 +599,7 @@ provide:
 
 ## Features
 
-- **Multiple Authentication Methods**: Supports passphrase, PGP, macOS Keychain,
-  and Secure Enclave unlockers
+- **Multiple Authentication Methods**: Supports passphrase and PGP unlockers
 - **Vault Isolation**: Complete separation between different vaults
 - **Per-Secret Encryption**: Each secret has its own encryption key
 - **BIP39 Mnemonic Support**: Keyless operation using mnemonic phrases