Read secret environment variables once per command, then unset them (closes #60)

init and vault create put the mnemonic into the process environment for
vault.CreateVault to read back, so every program they ran, gpg included,
inherited it, and SB_SECRET_MNEMONIC and SB_UNLOCK_PASSPHRASE were read
at 13 places and never unset. Each command that may need them now reads
both once, in its RunE, into locked buffers on the CLI Instance, and
unsets them at once. The buffers are passed down: vault.CreateVault
takes the mnemonic, a Vault carries Mnemonic and UnlockPassphrase, and
the PGP, keychain and Secure Enclave unlocker constructors take both;
CreatePGPUnlocker sets them on the vault it loads through SetMnemonic
and SetUnlockPassphrase, new in VaultInterface. README warns against
both variables.

Model: opus-5-5

internal/cli/unlockers_add_test.go

@@ -5,7 +5,6 @@ import (
 	"path/filepath"
 	"testing"
 
-	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
@@ -24,28 +23,31 @@ const (
 
 // TestAddPGPUnlocker adds a PGP unlocker for a throwaway GPG key to a vault
 // with a passphrase unlocker, getting the vault's long-term key from the
-// mnemonic or, with the mnemonic unset, from the passphrase unlocker. It
-// then reads a secret with neither the mnemonic nor the passphrase set, so
+// mnemonic or, with no mnemonic given, from the passphrase unlocker. It
+// then reads a secret with neither the mnemonic nor the passphrase given, so
 // through the new unlocker, which the add selects.
+//
+//nolint:paralleltest // t.Setenv (GNUPGHOME) forbids parallel tests
 func TestAddPGPUnlocker(t *testing.T) {
 	newTestGPGKey(t)
 
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	t.Cleanup(passphrase.Destroy)
+
 	tests := []struct {
 		name string
-		// mnemonic is the mnemonic set while the unlocker is added.
-		mnemonic string
+		// mnemonic is the mnemonic given while the unlocker is added, or nil.
+		mnemonic *memguard.LockedBuffer
 	}{
-		{"long-term key from the mnemonic", testMnemonic},
-		{"long-term key from the current unlocker", ""},
+		{"long-term key from the mnemonic", testMnemonicBuffer(t)},
+		{"long-term key from the current unlocker", nil},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			t.Setenv(secret.EnvMnemonic, testMnemonic)
-			t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
-
 			fs := afero.NewMemMapFs()
-			vlt, err := vault.CreateVault(fs, listTestStateDir, listTestVaultName)
+			vlt, err := vault.CreateVault(fs, listTestStateDir, listTestVaultName,
+				testMnemonicBuffer(t))
 			require.NoError(t, err)
 
 			err = vlt.AddSecret(addTestSecretName,
@@ -56,15 +58,13 @@ func TestAddPGPUnlocker(t *testing.T) {
 				memguard.NewBufferFromBytes([]byte(testPassphrase)))
 			require.NoError(t, err)
 
-			t.Setenv(secret.EnvMnemonic, test.mnemonic)
-
 			instance, cmd := newTestInstance(fs)
+			instance.Mnemonic = test.mnemonic
+			instance.UnlockPassphrase = passphrase
+
 			cmd.Flags().String("keyid", unreadableTestGPGUserID, "")
 			require.NoError(t, instance.UnlockersAdd(unlockerTypePGP, cmd))
 
-			t.Setenv(secret.EnvMnemonic, "")
-			t.Setenv(secret.EnvUnlockPassphrase, "")
-
 			reopened := vault.NewVault(fs, listTestStateDir, listTestVaultName)
 
 			current, err := reopened.GetCurrentUnlocker()