Use gpg.conf's default-key when unlocker add pgp has no --keyid (closes #141)

getDefaultGPGKey took the default-key value from `gpgconf --list-options
gpg` as printed. gpgconf prints a string value with a leading `"` and
percent-escaped, so gpg rejected the key ID. The parsing moved into
parseDefaultGPGKey, which drops the `"` and percent-decodes the rest with
url.PathUnescape, which leaves `+` alone. A value that does not decode is
an error, not a fallback to the first secret key.

Rule suppressed: gosec G703 on the test's write of gpg.conf into the
GNUPGHOME directory newTestGPGKey made.

Model: opus-5-5

TODO.md

@@ -18,6 +18,12 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-14: `secret unlocker add pgp` without `--keyid` uses the `default-key`
+  set in `gpg.conf` (https://git.eeqj.de/sneak/secret/issues/141). The key ID
+  came from `gpgconf --list-options gpg`, which prints a string value with a
+  leading `"` and percent-escaped, and was passed to gpg undecoded, so gpg
+  rejected it. The value is now decoded first. With no `default-key` set, the
+  first secret key is still used.
 - 2026-10-14: Removing the current unlocker no longer leaves the vault unable to
   open through the unlockers it still has
   (https://git.eeqj.de/sneak/secret/issues/137). `current-unlocker` went on