fix: resolve all nestif linter errors

- Extract getLongTermPrivateKey helper function to reduce nesting in keychainunlocker.go and pgpunlocker.go
- Add getPassphrase helper method to reduce nesting in passphraseunlocker.go
- Refactor version serial extraction to use early returns in version.go
- Extract resolveRelativeSymlink and tryResolveOsSymlink helpers in management.go
- Add processMnemonicForVault helper to reduce nesting in vault creation
- Extract resolveUnlockerDirectory and readUnlockerPathFromFile helpers in unlockers.go
- Add findUnlockerByID helper to reduce duplicate code in RemoveUnlocker and SelectUnlocker

All tests pass after refactoring.

internal/secret/version.go

@@ -89,17 +89,24 @@ func GenerateVersionName(fs afero.Fs, secretDir string) (string, error) {
 	prefix := today + "."
 
 	for _, entry := range entries {
-		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
-			// Extract serial number
-			parts := strings.Split(entry.Name(), ".")
-			if len(parts) == versionNameParts {
-				var serial int
-				if _, err := fmt.Sscanf(parts[1], "%03d", &serial); err == nil {
-					if serial > maxSerial {
-						maxSerial = serial
-					}
-				}
-			}
+		// Skip non-directories and those without correct prefix
+		if !entry.IsDir() || !strings.HasPrefix(entry.Name(), prefix) {
+			continue
+		}
+
+		// Extract serial number
+		parts := strings.Split(entry.Name(), ".")
+		if len(parts) != versionNameParts {
+			continue
+		}
+
+		var serial int
+		if _, err := fmt.Sscanf(parts[1], "%03d", &serial); err != nil {
+			continue
+		}
+
+		if serial > maxSerial {
+			maxSerial = serial
 		}
 	}