Give every new unlocker a directory of its own (closes #71)

A passphrase unlocker added to a vault that had one, and a PGP, keychain
or Secure Enclave unlocker added on the same day as another of its type,
were written into the existing unlocker's directory file by file, so a
crash part-way left a current unlocker whose files did not belong
together.

Unlocker directories, keychain items and Secure Enclave keys are now
named with the time to the nanosecond, and secret.WriteDir refuses a
directory that exists. Adding a passphrase unlocker writes the new one,
points current-unlocker at it, and only then removes the vault's other
passphrase unlockers.

Model: opus-5-5

internal/secret/pgpunlocker.go

@@ -209,21 +209,20 @@ func (p *PGPUnlocker) GetGPGKeyID() (string, error) {
 }
 
 // generatePGPUnlockerName generates a unique name for the PGP unlocker
-// based on hostname and date
+// based on hostname and time
 func generatePGPUnlockerName() (string, error) {
 	hostname, err := os.Hostname()
 	if err != nil {
 		return "", fmt.Errorf("failed to get hostname: %w", err)
 	}
 
-	// Format: hostname-pgp-YYYY-MM-DD
-	enrollmentDate := time.Now().Format("2006-01-02")
+	enrollmentTime := time.Now().UTC().Format(UnlockerTimeFormat)
 
-	return fmt.Sprintf("%s-pgp-%s", hostname, enrollmentDate), nil
+	return fmt.Sprintf("%s-pgp-%s", hostname, enrollmentTime), nil
 }
 
 // pgpUnlockerDir returns the current vault and the directory in it for a
-// new PGP unlocker, named after the host and the day.
+// new PGP unlocker, named after the host and the time.
 //
 //nolint:ireturn // the vault is only available behind VaultInterface
 func pgpUnlockerDir(
@@ -235,7 +234,7 @@ func pgpUnlockerDir(
 		return nil, "", fmt.Errorf("failed to get current vault: %w", err)
 	}
 
-	// Generate the unlocker name based on hostname and date
+	// Generate the unlocker name based on hostname and time
 	unlockerName, err := generatePGPUnlockerName()
 	if err != nil {
 		return nil, "", fmt.Errorf("failed to generate unlocker name: %w", err)