fix: resolve all nestif linter errors

- Extract getLongTermPrivateKey helper function to reduce nesting in keychainunlocker.go and pgpunlocker.go
- Add getPassphrase helper method to reduce nesting in passphraseunlocker.go
- Refactor version serial extraction to use early returns in version.go
- Extract resolveRelativeSymlink and tryResolveOsSymlink helpers in management.go
- Add processMnemonicForVault helper to reduce nesting in vault creation
- Extract resolveUnlockerDirectory and readUnlockerPathFromFile helpers in unlockers.go
- Add findUnlockerByID helper to reduce duplicate code in RemoveUnlocker and SelectUnlocker

All tests pass after refactoring.

internal/secret/passphraseunlocker.go

@@ -18,6 +18,32 @@ type PassphraseUnlocker struct {
 	Passphrase string
 }
 
+// getPassphrase retrieves the passphrase from memory, environment, or user input
+func (p *PassphraseUnlocker) getPassphrase() (string, error) {
+	// First check if we already have the passphrase
+	if p.Passphrase != "" {
+		Debug("Using in-memory passphrase", "unlocker_id", p.GetID())
+		return p.Passphrase, nil
+	}
+
+	Debug("No passphrase in memory, checking environment")
+	// Check environment variable for passphrase
+	passphraseStr := os.Getenv(EnvUnlockPassphrase)
+	if passphraseStr != "" {
+		Debug("Using passphrase from environment", "unlocker_id", p.GetID())
+		return passphraseStr, nil
+	}
+
+	Debug("No passphrase in environment, prompting user")
+	// Prompt for passphrase
+	passphraseStr, err := ReadPassphrase("Enter unlock passphrase: ")
+	if err != nil {
+		Debug("Failed to read passphrase", "error", err, "unlocker_id", p.GetID())
+		return "", fmt.Errorf("failed to read passphrase: %w", err)
+	}
+	return passphraseStr, nil
+}
+
 // GetIdentity implements Unlocker interface for passphrase-based unlockers
 func (p *PassphraseUnlocker) GetIdentity() (*age.X25519Identity, error) {
 	DebugWith("Getting passphrase unlocker identity",
@@ -25,26 +51,9 @@ func (p *PassphraseUnlocker) GetIdentity() (*age.X25519Identity, error) {
 		slog.String("unlocker_type", p.GetType()),
 	)
 
-	// First check if we already have the passphrase
-	passphraseStr := p.Passphrase
-	if passphraseStr == "" {
-		Debug("No passphrase in memory, checking environment")
-		// Check environment variable for passphrase
-		passphraseStr = os.Getenv(EnvUnlockPassphrase)
-		if passphraseStr == "" {
-			Debug("No passphrase in environment, prompting user")
-			// Prompt for passphrase
-			var err error
-			passphraseStr, err = ReadPassphrase("Enter unlock passphrase: ")
-			if err != nil {
-				Debug("Failed to read passphrase", "error", err, "unlocker_id", p.GetID())
-				return nil, fmt.Errorf("failed to read passphrase: %w", err)
-			}
-		} else {
-			Debug("Using passphrase from environment", "unlocker_id", p.GetID())
-		}
-	} else {
-		Debug("Using in-memory passphrase", "unlocker_id", p.GetID())
+	passphraseStr, err := p.getPassphrase()
+	if err != nil {
+		return nil, err
 	}
 
 	// Read encrypted private key of unlocker