Fix cross-platform build issues and security vulnerabilities

- Add build tags to keychain implementation files (Darwin-only)
- Create stub implementations for non-Darwin platforms that panic
- Conditionally show keychain support in help text based on platform
- Platform check in UnlockersAdd prevents keychain usage on non-Darwin
- Verified GPG operations already protected against command injection
  via validateGPGKeyID() and proper exec.Command argument passing
- Keychain operations use go-keychain library, no shell commands

The application now builds and runs on Linux/non-Darwin platforms with
keychain functionality properly isolated to macOS only.

internal/cli/unlockers.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"time"
 
@@ -90,10 +91,16 @@ func newUnlockersListCmd() *cobra.Command {
 }
 
 func newUnlockersAddCmd() *cobra.Command {
+	// Build the supported types list based on platform
+	supportedTypes := "passphrase, pgp"
+	if runtime.GOOS == "darwin" {
+		supportedTypes = "passphrase, keychain, pgp"
+	}
+
 	cmd := &cobra.Command{
 		Use:   "add <type> [keyid]",
 		Short: "Add a new unlocker",
-		Long:  `Add a new unlocker of the specified type (passphrase, keychain, pgp).`,
+		Long:  fmt.Sprintf(`Add a new unlocker of the specified type (%s).`, supportedTypes),
 		Args:  cobra.RangeArgs(1, 2), //nolint:mnd // Command accepts 1 or 2 arguments
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cli := NewCLIInstance()
@@ -295,6 +302,12 @@ func (cli *Instance) UnlockersList(jsonOutput bool) error {
 
 // UnlockersAdd adds a new unlocker
 func (cli *Instance) UnlockersAdd(unlockerType string, cmd *cobra.Command) error {
+	// Build the supported types list based on platform
+	supportedTypes := "passphrase, pgp"
+	if runtime.GOOS == "darwin" {
+		supportedTypes = "passphrase, keychain, pgp"
+	}
+
 	switch unlockerType {
 	case "passphrase":
 		// Get current vault
@@ -329,6 +342,10 @@ func (cli *Instance) UnlockersAdd(unlockerType string, cmd *cobra.Command) error
 		return nil
 
 	case "keychain":
+		if runtime.GOOS != "darwin" {
+			return fmt.Errorf("keychain unlockers are only supported on macOS")
+		}
+
 		keychainUnlocker, err := secret.CreateKeychainUnlocker(cli.fs, cli.stateDir)
 		if err != nil {
 			return fmt.Errorf("failed to create macOS Keychain unlocker: %w", err)
@@ -387,7 +404,7 @@ func (cli *Instance) UnlockersAdd(unlockerType string, cmd *cobra.Command) error
 		return nil
 
 	default:
-		return fmt.Errorf("unsupported unlocker type: %s (supported: passphrase, keychain, pgp)", unlockerType)
+		return fmt.Errorf("unsupported unlocker type: %s (supported: %s)", unlockerType, supportedTypes)
 	}
 }