Make secret unlocker add pgp work on Linux (closes #88)

CreatePGPUnlocker got the vault's long-term key from the keychain
unlocker's helper, which on every platform but macOS is a stub that
always fails. It now calls the vault's GetOrDeriveLongTermKey, as adding
a passphrase unlocker does: from the mnemonic, checked against the
vault, or else from the current unlocker. That method joins
VaultInterface. The test GPG key gains an encryption subkey, and a new
test adds a PGP unlocker with the long-term key from the mnemonic and
from a passphrase unlocker, then reads a secret through it.

Model: opus-5-5

internal/cli/unreadable_dir_test.go

@@ -122,7 +122,8 @@ func assertDirEntries(t *testing.T, fs afero.Fs, dir string, want ...string) {
 }
 
 // newTestGPGKey points GNUPGHOME at a fresh directory, generates a GPG key
-// without a passphrase there, and returns the key's fingerprint.
+// without a passphrase there, with a subkey for encryption, and returns the
+// key's fingerprint.
 func newTestGPGKey(t *testing.T) string {
 	t.Helper()
 
@@ -151,6 +152,14 @@ func newTestGPGKey(t *testing.T) string {
 	fingerprint, err := secret.ResolveGPGKeyFingerprint(unreadableTestGPGUserID)
 	require.NoError(t, err)
 
+	//nolint:gosec // G204: fingerprint is the test key's, as gpg printed it
+	output, err = exec.CommandContext(t.Context(), "gpg", "--batch",
+		"--pinentry-mode", "loopback", "--passphrase", "",
+		"--quick-add-key", fingerprint, "cv25519", "encr", "never",
+	).CombinedOutput()
+	require.NoError(t, err, "adding the test GPG key's encryption subkey: %s",
+		output)
+
 	return fingerprint
 }