Read secret environment variables once per command, then unset them (closes #60)

init and vault create put the mnemonic into the process environment for
vault.CreateVault to read back, so every program they ran, gpg included,
inherited it, and SB_SECRET_MNEMONIC and SB_UNLOCK_PASSPHRASE were read
at 13 places and never unset. Each command that may need them now reads
both once, in its RunE, into locked buffers on the CLI Instance, and
unsets them at once. The buffers are passed down: vault.CreateVault
takes the mnemonic, a Vault carries Mnemonic and UnlockPassphrase, and
the PGP, keychain and Secure Enclave unlocker constructors take both.
Nothing below the command reads the environment. README warns against
both variables.

Model: opus-5-5

internal/vault/secrets_version_test.go

@@ -41,14 +41,6 @@ import (
 const testMnemonic = "abandon abandon abandon abandon abandon abandon abandon " +
 	"abandon abandon abandon abandon about"
 
-// envTestMnemonic is the (deliberately different) mnemonic placed in the
-// environment; the vault is unlocked manually with the derived key in
-// createTestVaultWithKey.
-//
-//nolint:dupword // BIP39-style test mnemonic intentionally repeats a word
-const envTestMnemonic = "abandon abandon abandon abandon abandon abandon " +
-	"abandon abandon abandon about"
-
 // Shared fixtures for white-box tests in this package.
 const (
 	testStateDir   = "/test/state"
@@ -73,11 +65,8 @@ func addTestSecretToVault(
 func createTestVaultWithKey(t *testing.T, fs afero.Fs) *Vault {
 	t.Helper()
 
-	// Set mnemonic for testing
-	t.Setenv(secret.EnvMnemonic, envTestMnemonic)
-
-	// Create vault
-	vault, err := CreateVault(fs, testStateDir, "test")
+	// Create vault without a long-term key, which is set up below
+	vault, err := CreateVault(fs, testStateDir, "test", nil)
 	require.NoError(t, err)
 
 	// Derive and store long-term key from mnemonic
@@ -98,8 +87,9 @@ func createTestVaultWithKey(t *testing.T, fs afero.Fs) *Vault {
 	return vault
 }
 
-//nolint:paralleltest // createTestVaultWithKey uses t.Setenv
 func TestVaultAddSecretCreatesVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 
 	// Create vault with long-term key
@@ -137,8 +127,9 @@ func TestVaultAddSecretCreatesVersion(t *testing.T) {
 	assert.Equal(t, expectedValue, retrievedValue.Bytes())
 }
 
-//nolint:paralleltest // createTestVaultWithKey uses t.Setenv
 func TestVaultAddSecretMultipleVersions(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 
 	// Create vault with long-term key
@@ -174,8 +165,9 @@ func TestVaultAddSecretMultipleVersions(t *testing.T) {
 	assert.Equal(t, []byte("version-2"), value.Bytes())
 }
 
-//nolint:paralleltest // createTestVaultWithKey uses t.Setenv
 func TestVaultGetSecretVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 
 	// Create vault with long-term key
@@ -220,8 +212,9 @@ func TestVaultGetSecretVersion(t *testing.T) {
 	require.ErrorIs(t, err, ErrVersionNotFound)
 }
 
-//nolint:paralleltest // createTestVaultWithKey uses t.Setenv
 func TestVaultVersionTimestamps(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 
 	// Create vault with long-term key
@@ -303,8 +296,9 @@ func TestVaultVersionTimestamps(t *testing.T) {
 	assert.Nil(t, secondVersion.Metadata.NotAfter) // Current version
 }
 
-//nolint:paralleltest // createTestVaultWithKey uses t.Setenv
 func TestVaultGetNonExistentVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 
 	// Create vault with long-term key
@@ -319,8 +313,9 @@ func TestVaultGetNonExistentVersion(t *testing.T) {
 	assert.Contains(t, err.Error(), "not found")
 }
 
-//nolint:paralleltest // createTestVaultWithKey uses t.Setenv
 func TestUpdateVersionMetadata(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 
 	// Create vault with long-term key