Wipe memguard buffers on every exit, restore echo on Ctrl-C (closes #35)

Entry() now returns the exit code and only main calls os.Exit, so the
deferred memguard.Purge() in Entry() runs on success and on error;
before, os.Exit(1) skipped every deferred Destroy().

SIGINT and SIGTERM go through memguard's handler, which wipes every
buffer and exits with status 1. The passphrase prompt turns terminal
echo off until its read returns, and the handler exits before that, so
on Ctrl-C the handler first restores the terminal settings saved at
startup. It leaves the terminal alone on SIGTERM, which can reach a
background process, and changing the terminal from the background would
stop the process.

Model: opus-5-5

internal/cli/root.go

@@ -2,19 +2,39 @@ package cli
 
 import (
 	"os"
+	"syscall"
 
 	"git.eeqj.de/sneak/secret/internal/secret"
+	"github.com/awnumar/memguard"
 	"github.com/spf13/cobra"
+	"golang.org/x/term"
 )
 
-// Entry is the entry point for the secret CLI application
-func Entry() {
-	cmd := newRootCmd()
+// Entry runs the secret CLI and returns the process exit code. It wipes
+// every memguard buffer before it returns, so the caller must do nothing
+// but exit with the code.
+func Entry() int {
+	// On SIGINT or SIGTERM memguard runs this function, wipes every buffer
+	// and exits with status 1. The passphrase prompt turns terminal echo
+	// off until the read finishes, so Ctrl-C there would leave echo off.
+	// Ctrl-C means this process is in the terminal's foreground and may
+	// reset it; doing that from the background would stop the process.
+	terminalState, terminalErr := term.GetState(syscall.Stdin)
 
-	err := cmd.Execute()
+	memguard.CatchSignal(func(sig os.Signal) {
+		if sig == os.Interrupt && terminalErr == nil {
+			_ = term.Restore(syscall.Stdin, terminalState)
+		}
+	}, os.Interrupt, syscall.SIGTERM)
+
+	defer memguard.Purge()
+
+	err := newRootCmd().Execute()
 	if err != nil {
-		os.Exit(1)
+		return 1
 	}
+
+	return 0
 }
 
 func newRootCmd() *cobra.Command {