Remove the keychain and Secure Enclave unlockers (closes #132)

Neither unlocker works without macOS code signing and entitlements, which
secret does not have, so both were research and leave the build.
`secret unlocker add` takes only passphrase and pgp on every platform;
keychain and secure-enclave fail as unknown types and are gone from
--help and shell completion. internal/macse, their files in
internal/secret with their tests, and their branches in internal/vault
and internal/cli are deleted; github.com/keybase/go-keychain leaves
go.mod and go.sum. README and Dockerfile comments no longer mention
them. The research stays at ef0ae90, tagged v1.0.0-rc1.

Judgement call: derivation_index_test.go goes with getLongTermPrivateKey,
its only subject, which only these two unlockers used.
Unverified: not built or run on a Mac; only the GOOS=darwin vet and lint ran.

Model: opus-5-5

internal/vault/unlockers.go

@@ -18,8 +18,7 @@ import (
 
 // Unlocker metadata type strings.
 const (
-	unlockerTypePassphrase    = "passphrase"
-	unlockerTypeSecureEnclave = "secure-enclave"
+	unlockerTypePassphrase = "passphrase"
 )
 
 // GetCurrentUnlocker returns the current unlocker for this vault
@@ -79,15 +78,6 @@ func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 		secret.Debug("Creating PGP unlocker instance", "unlocker_type", metadata.Type)
 
 		unlocker = secret.NewPGPUnlocker(v.fs, unlockerDir, metadata)
-	case "keychain":
-		secret.Debug("Creating keychain unlocker instance", "unlocker_type", metadata.Type)
-
-		unlocker = secret.NewKeychainUnlocker(v.fs, unlockerDir, metadata)
-	case unlockerTypeSecureEnclave:
-		secret.Debug("Creating secure enclave unlocker instance",
-			"unlocker_type", metadata.Type)
-
-		unlocker = secret.NewSecureEnclaveUnlocker(v.fs, unlockerDir, metadata)
 	default:
 		secret.Debug("Unsupported unlocker type", "type", metadata.Type)
 
@@ -171,10 +161,6 @@ func (v *Vault) findUnlockerByID(
 			tempUnlocker = secret.NewPassphraseUnlocker(v.fs, unlockerDirPath, metadata)
 		case "pgp":
 			tempUnlocker = secret.NewPGPUnlocker(v.fs, unlockerDirPath, metadata)
-		case "keychain":
-			tempUnlocker = secret.NewKeychainUnlocker(v.fs, unlockerDirPath, metadata)
-		case unlockerTypeSecureEnclave:
-			tempUnlocker = secret.NewSecureEnclaveUnlocker(v.fs, unlockerDirPath, metadata)
 		default:
 			continue
 		}

internal/vault/vault.go

@@ -109,9 +109,8 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 		slog.String("unlocker_id", unlocker.GetID()),
 	)
 
-	// Get the long-term key via the unlocker.
-	// SE unlockers return the long-term key directly from GetIdentity().
-	// Other unlockers return their own identity, used to decrypt longterm.age.
+	// Get the long-term key via the unlocker: its identity decrypts
+	// longterm.age.
 	ltIdentity, err := v.unlockLongTermKey(unlocker)
 	if err != nil {
 		return nil, v.withMnemonicAdvice(err)
@@ -254,23 +253,10 @@ func (v *Vault) deriveLongTermKeyFromMnemonic(
 }
 
 // unlockLongTermKey extracts the vault's long-term key using the given
-// unlocker. SE unlockers decrypt the long-term key directly; other unlockers
-// use an intermediate identity.
+// unlocker's identity.
 func (v *Vault) unlockLongTermKey(
 	unlocker secret.Unlocker,
 ) (*age.X25519Identity, error) {
-	if unlocker.GetType() == unlockerTypeSecureEnclave {
-		secret.Debug("SE unlocker: decrypting long-term key directly via Secure Enclave")
-
-		ltIdentity, err := unlocker.GetIdentity()
-		if err != nil {
-			return nil, fmt.Errorf("failed to decrypt long-term key via SE: %w", err)
-		}
-
-		return ltIdentity, nil
-	}
-
-	// Standard unlockers: get unlocker identity, then decrypt longterm.age
 	unlockerIdentity, err := unlocker.GetIdentity()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get unlocker identity: %w", err)