Make an unlocker's ID the name of its directory (closes #98)

Keychain and Secure Enclave unlocker IDs were the creation time to the
minute plus the host name, and passphrase unlocker IDs the time to the
minute, so two created within one minute shared an ID, and `unlocker
select`, `unlocker remove` and the selection after `unlocker add` acted on
the older one. Every unlocker's ID is now its directory name, unique in
its vault. PGP unlocker IDs were `pgp-<fingerprint>`; the check that
refuses a second PGP unlocker for one key now compares the fingerprint in
the other unlockers' metadata.

Model: opus-5-5

TODO.md

@@ -18,6 +18,18 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-04: An unlocker's ID is the name of its directory in `unlockers.d`,
+  so no two unlockers of a vault share one
+  (https://git.eeqj.de/sneak/secret/issues/98). Before, a keychain or Secure
+  Enclave unlocker's ID was its creation time to the minute and the host name,
+  and a passphrase unlocker's the time to the minute, so two created within a
+  minute shared an ID, and `unlocker select`, `unlocker remove` and the
+  selection `unlocker add` makes acted on the older one. A PGP unlocker's ID
+  was `pgp-` and its key's fingerprint; a second PGP unlocker for a key is
+  still refused, now by comparing the fingerprint in the other unlockers'
+  metadata. The keychain and Secure Enclave code was type-checked by
+  `script/lint-darwin`, never run; a test on Linux lists, selects and removes
+  each of two passphrase unlockers created in one minute by its own ID.
 - 2026-10-04: A failed `secret unlocker add keychain` or
   `secret unlocker add secure-enclave` no longer leaves its keychain item or
   Secure Enclave key behind (https://git.eeqj.de/sneak/secret/issues/89).