Remove the keychain and Secure Enclave unlockers (closes #132)

Neither unlocker works without macOS code signing and entitlements, which
secret does not have, so both were research and leave the build.
`secret unlocker add` takes only passphrase and pgp on every platform;
keychain and secure-enclave fail as unknown types and are gone from
--help and shell completion. internal/macse, their files in
internal/secret with their tests, and their branches in internal/vault
and internal/cli are deleted; github.com/keybase/go-keychain leaves
go.mod and go.sum. README and Dockerfile comments no longer mention
them. The research stays at ef0ae90, tagged v1.0.0-rc1.

Judgement call: derivation_index_test.go goes with getLongTermPrivateKey,
its only subject, which only these two unlockers used.
Unverified: not built or run on a Mac; only the GOOS=darwin vet and lint ran.

Model: opus-5-5

internal/cli/unlockers_add_test.go

@@ -3,6 +3,7 @@ package cli
 
 import (
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/awnumar/memguard"
@@ -104,3 +105,40 @@ func TestAddPGPUnlockerUnknownKey(t *testing.T) {
 		filepath.Join(testVaultDir(listTestVaultName), listTestUnlockersDirName),
 		listTestUnlockerDirOne)
 }
+
+// TestUnlockerAddKnowsOnlyPassphraseAndPGP is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/132: `secret unlocker add` takes
+// only passphrase and pgp, on every platform. keychain and secure-enclave
+// fail as unknown types, and neither --help nor shell completion offers
+// them.
+//
+//nolint:paralleltest // executes the CLI in-process and sets the environment
+func TestUnlockerAddKnowsOnlyPassphraseAndPGP(t *testing.T) {
+	env := map[string]string{secret.EnvStateDir: t.TempDir()}
+	removedTypes := []string{"keychain", "secure-enclave"}
+
+	for _, unlockerType := range removedTypes {
+		_, err := ExecuteCommandInProcess(
+			[]string{"unlocker", "add", unlockerType}, "", env)
+		require.ErrorIs(t, err, errInvalidUnlockerType)
+
+		instance, cmd := newTestInstance(newListTestVault(t, 1))
+		require.ErrorIs(t, instance.UnlockersAdd(unlockerType, cmd),
+			errInvalidUnlockerType)
+	}
+
+	// --help prints the command's Long text, and shell completion offers
+	// its ValidArgs.
+	addCmd := newUnlockerAddCmd()
+	help := addCmd.Long
+	completions := strings.Join(addCmd.ValidArgs, " ")
+
+	for _, offered := range []string{help, completions} {
+		assert.Contains(t, offered, unlockerTypePassphrase)
+		assert.Contains(t, offered, unlockerTypePGP)
+
+		for _, unlockerType := range removedTypes {
+			assert.NotContains(t, offered, unlockerType)
+		}
+	}
+}